Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(9)

Side by Side Diff: ui/webui/resources/js/parse_html_subset.js

Issue 2597013002: Run clang-format on ui/webui/resources (Closed)
Patch Set: remove cr_shared_menu.js Created 3 years, 12 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 /** 5 /**
6 * Parses a very small subset of HTML. This ensures that insecure HTML / 6 * Parses a very small subset of HTML. This ensures that insecure HTML /
7 * javascript cannot be injected into the new tab page. 7 * javascript cannot be injected into the new tab page.
8 * @param {string} s The string to parse. 8 * @param {string} s The string to parse.
9 * @param {Array<string>=} opt_extraTags Optional extra allowed tags. 9 * @param {Array<string>=} opt_extraTags Optional extra allowed tags.
10 * @param {Object<function(Node, string):boolean>=} opt_extraAttrs 10 * @param {Object<function(Node, string):boolean>=} opt_extraAttrs
11 * Optional extra allowed attributes (all tags are run through these). 11 * Optional extra allowed attributes (all tags are run through these).
12 * @throws {Error} In case of non supported markup. 12 * @throws {Error} In case of non supported markup.
13 * @return {DocumentFragment} A document fragment containing the DOM tree. 13 * @return {DocumentFragment} A document fragment containing the DOM tree.
14 */ 14 */
15 var parseHtmlSubset = (function() { 15 var parseHtmlSubset = (function() {
16 'use strict'; 16 'use strict';
17 17
18 var allowedAttributes = { 18 var allowedAttributes = {
19 'href': function(node, value) { 19 'href': function(node, value) {
20 // Only allow a[href] starting with chrome:// and https:// 20 // Only allow a[href] starting with chrome:// and https://
21 return node.tagName == 'A' && (value.startsWith('chrome://') || 21 return node.tagName == 'A' &&
22 value.startsWith('https://')); 22 (value.startsWith('chrome://') || value.startsWith('https://'));
23 }, 23 },
24 'target': function(node, value) { 24 'target': function(node, value) {
25 // Only allow a[target='_blank']. 25 // Only allow a[target='_blank'].
26 // TODO(dbeam): are there valid use cases for target != '_blank'? 26 // TODO(dbeam): are there valid use cases for target != '_blank'?
27 return node.tagName == 'A' && value == '_blank'; 27 return node.tagName == 'A' && value == '_blank';
28 }, 28 },
29 }; 29 };
30 30
31 /** 31 /**
32 * Whitelist of tag names allowed in parseHtmlSubset. 32 * Whitelist of tag names allowed in parseHtmlSubset.
(...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after
94 case Node.TEXT_NODE: 94 case Node.TEXT_NODE:
95 break; 95 break;
96 96
97 default: 97 default:
98 throw Error('Node type ' + node.nodeType + ' is not supported'); 98 throw Error('Node type ' + node.nodeType + ' is not supported');
99 } 99 }
100 }); 100 });
101 return df; 101 return df;
102 }; 102 };
103 })(); 103 })();
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698