OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 /** | 5 /** |
6 * Parses a very small subset of HTML. This ensures that insecure HTML / | 6 * Parses a very small subset of HTML. This ensures that insecure HTML / |
7 * javascript cannot be injected into the new tab page. | 7 * javascript cannot be injected into the new tab page. |
8 * @param {string} s The string to parse. | 8 * @param {string} s The string to parse. |
9 * @param {Array<string>=} opt_extraTags Optional extra allowed tags. | 9 * @param {Array<string>=} opt_extraTags Optional extra allowed tags. |
10 * @param {Object<function(Node, string):boolean>=} opt_extraAttrs | 10 * @param {Object<function(Node, string):boolean>=} opt_extraAttrs |
11 * Optional extra allowed attributes (all tags are run through these). | 11 * Optional extra allowed attributes (all tags are run through these). |
12 * @throws {Error} In case of non supported markup. | 12 * @throws {Error} In case of non supported markup. |
13 * @return {DocumentFragment} A document fragment containing the DOM tree. | 13 * @return {DocumentFragment} A document fragment containing the DOM tree. |
14 */ | 14 */ |
15 var parseHtmlSubset = (function() { | 15 var parseHtmlSubset = (function() { |
16 'use strict'; | 16 'use strict'; |
17 | 17 |
18 var allowedAttributes = { | 18 var allowedAttributes = { |
19 'href': function(node, value) { | 19 'href': function(node, value) { |
20 // Only allow a[href] starting with chrome:// and https:// | 20 // Only allow a[href] starting with chrome:// and https:// |
21 return node.tagName == 'A' && (value.startsWith('chrome://') || | 21 return node.tagName == 'A' && |
22 value.startsWith('https://')); | 22 (value.startsWith('chrome://') || value.startsWith('https://')); |
23 }, | 23 }, |
24 'target': function(node, value) { | 24 'target': function(node, value) { |
25 // Only allow a[target='_blank']. | 25 // Only allow a[target='_blank']. |
26 // TODO(dbeam): are there valid use cases for target != '_blank'? | 26 // TODO(dbeam): are there valid use cases for target != '_blank'? |
27 return node.tagName == 'A' && value == '_blank'; | 27 return node.tagName == 'A' && value == '_blank'; |
28 }, | 28 }, |
29 }; | 29 }; |
30 | 30 |
31 /** | 31 /** |
32 * Whitelist of tag names allowed in parseHtmlSubset. | 32 * Whitelist of tag names allowed in parseHtmlSubset. |
(...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
94 case Node.TEXT_NODE: | 94 case Node.TEXT_NODE: |
95 break; | 95 break; |
96 | 96 |
97 default: | 97 default: |
98 throw Error('Node type ' + node.nodeType + ' is not supported'); | 98 throw Error('Node type ' + node.nodeType + ' is not supported'); |
99 } | 99 } |
100 }); | 100 }); |
101 return df; | 101 return df; |
102 }; | 102 }; |
103 })(); | 103 })(); |
OLD | NEW |