Index: pkg/dev_compiler/tool/input_sdk/lib/convert/html_escape.dart |
diff --git a/pkg/dev_compiler/tool/input_sdk/lib/convert/html_escape.dart b/pkg/dev_compiler/tool/input_sdk/lib/convert/html_escape.dart |
deleted file mode 100644 |
index ff74442e1c8ebaa01f1ff670ff822e85b484c76b..0000000000000000000000000000000000000000 |
--- a/pkg/dev_compiler/tool/input_sdk/lib/convert/html_escape.dart |
+++ /dev/null |
@@ -1,231 +0,0 @@ |
-// Copyright (c) 2013, the Dart project authors. Please see the AUTHORS file |
-// for details. All rights reserved. Use of this source code is governed by a |
-// BSD-style license that can be found in the LICENSE file. |
- |
-part of dart.convert; |
- |
-/** |
- * A `String` converter that converts characters to HTML entities. |
- * |
- * This is intended to sanitice text before inserting the text into an HTML |
- * document. Characters that are meaningful in HTML are converted to |
- * HTML entities (like `&` for `&`). |
- * |
- * The general converter escapes all characters that are meaningful in HTML |
- * attributes or normal element context. Elements with special content types |
- * (like CSS or JavaScript) may need a more specialized escaping that |
- * understands that content type. |
- * |
- * If the context where the text will be inserted is known in more detail, |
- * it's possible to omit escaping some characters (like quotes when not |
- * inside an attribute value). |
- * |
- * The escaped text should only be used inside quoted HTML attributes values |
- * or as text content of a normal element. Using the escaped text inside a |
- * tag, but not inside a quoted attribute value, is still dangerous. |
- */ |
-const HtmlEscape HTML_ESCAPE = const HtmlEscape(); |
- |
-/** |
- * HTML escape modes. |
- * |
- * Allows specifying a mode for HTML escaping that depend on the context |
- * where the escaped result is going to be used. |
- * The relevant contexts are: |
- * |
- * * as text content of an HTML element. |
- * * as value of a (single- or double-) quoted attribute value. |
- * |
- * All modes require escaping of `&` (ampersand) characters, and may |
- * enable escaping of more characters. |
- * |
- * Custom escape modes can be created using the [HtmlEscapeMode.HtmlEscapeMode] |
- * constructor. |
- */ |
-class HtmlEscapeMode { |
- final String _name; |
- /** Whether to escape '<' and '>'. */ |
- final bool escapeLtGt; |
- /** Whether to escape '"' (quote). */ |
- final bool escapeQuot; |
- /** Whether to escape "'" (apostrophe). */ |
- final bool escapeApos; |
- /** |
- * Whether to escape "/" (forward slash, solidus). |
- * |
- * Escaping a slash is recommended to avoid cross-site scripting attacks by |
- * [the Open Web Application Security Project](https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content) |
- */ |
- final bool escapeSlash; |
- |
- /** |
- * Default escaping mode which escape all characters. |
- * |
- * The result of such an escaping is usable both in element content and |
- * in any attribute value. |
- * |
- * The escaping only works for elements with normal HTML content, |
- * and not for, for example, script or style element content, |
- * which require escapes matching their particular content syntax. |
- */ |
- static const HtmlEscapeMode UNKNOWN = |
- const HtmlEscapeMode._('unknown', true, true, true, true); |
- |
- /** |
- * Escaping mode for text going into double-quoted HTML attribute values. |
- * |
- * The result should not be used as the content of an unquoted |
- * or single-quoted attribute value. |
- * |
- * Escapes double quotes (`"`) but not single quotes (`'`), |
- * and escapes `<` and `>` characters because they are not allowed |
- * in strict XHTML attributes |
- */ |
- static const HtmlEscapeMode ATTRIBUTE = |
- const HtmlEscapeMode._('attribute', true, true, false, false); |
- |
- /** |
- * Escaping mode for text going into single-quoted HTML attribute values. |
- * |
- * The result should not be used as the content of an unquoted |
- * or double-quoted attribute value. |
- * |
- * Escapes single quotes (`'`) but not double quotes (`"`), |
- * and escapes `<` and `>` characters because they are not allowed |
- * in strict XHTML attributes |
- */ |
- static const HtmlEscapeMode SQ_ATTRIBUTE = |
- const HtmlEscapeMode._('attribute', true, false, true, false); |
- |
- /** |
- * Escaping mode for text going into HTML element content. |
- * |
- * The escaping only works for elements with normal HTML content, |
- * and not for, for example, script or style element content, |
- * which require escapes matching their particular content syntax. |
- * |
- * Escapes `<` and `>` characters. |
- */ |
- static const HtmlEscapeMode ELEMENT = |
- const HtmlEscapeMode._('element', true, false, false, false); |
- |
- const HtmlEscapeMode._(this._name, |
- this.escapeLtGt, |
- this.escapeQuot, |
- this.escapeApos, |
- this.escapeSlash); |
- |
- /** |
- * Create a custom escaping mode. |
- * |
- * All modes escape `&`. |
- * The mode can further be set to escape `<` and `>` ([escapeLtGt]), |
- * `"` ([escapeQuot]), `'` ([escapeApos]), and/or `/` ([escapeSlash]). |
- */ |
- const HtmlEscapeMode({String name: "custom", |
- this.escapeLtGt: false, |
- this.escapeQuot: false, |
- this.escapeApos: false, |
- this.escapeSlash: false}) : _name = name; |
- |
- String toString() => _name; |
-} |
- |
-/** |
- * Converter which escapes characters with special meaning in HTML. |
- * |
- * The converter finds characters that are siginificant in HTML source and |
- * replaces them with corresponding HTML entities. |
- * |
- * The characters that need escaping in HTML are: |
- * |
- * * `&` (ampersand) always need to be escaped. |
- * * `<` (less than) and '>' (greater than) when inside an element. |
- * * `"` (quote) when inside a double-quoted attribute value. |
- * * `'` (apostrophe) when inside a single-quoted attribute value. |
- * Apostrophe is escaped as `'` instead of `'` since |
- * not all browsers understand `'`. |
- * * `/` (slash) is recommended to be escaped because it may be used |
- * to terminate an element in some HTML dialects. |
- * |
- * Escaping `>` (greater than) isn't necessary, but the result is often |
- * found to be easier to read if greater-than is also escaped whenever |
- * less-than is. |
- */ |
-class HtmlEscape extends Converter<String, String> { |
- |
- /** The [HtmlEscapeMode] used by the converter. */ |
- final HtmlEscapeMode mode; |
- |
- /** |
- * Create converter that escapes HTML characters. |
- * |
- * If [mode] is provided as either [HtmlEscapeMode.ATTRIBUTE] or |
- * [HtmlEscapeMode.ELEMENT], only the corresponding subset of HTML |
- * characters are escaped. |
- * The default is to escape all HTML characters. |
- */ |
- const HtmlEscape([this.mode = HtmlEscapeMode.UNKNOWN]); |
- |
- String convert(String text) { |
- var val = _convert(text, 0, text.length); |
- return val == null ? text : val; |
- } |
- |
- /** |
- * Converts the substring of text from start to end. |
- * |
- * Returns `null` if no changes were necessary, otherwise returns |
- * the converted string. |
- */ |
- String _convert(String text, int start, int end) { |
- StringBuffer result = null; |
- for (int i = start; i < end; i++) { |
- var ch = text[i]; |
- String replacement = null; |
- switch (ch) { |
- case '&': replacement = '&'; break; |
- case '"': if (mode.escapeQuot) replacement = '"'; break; |
- case "'": if (mode.escapeApos) replacement = '''; break; |
- case '<': if (mode.escapeLtGt) replacement = '<'; break; |
- case '>': if (mode.escapeLtGt) replacement = '>'; break; |
- case '/': if (mode.escapeSlash) replacement = '/'; break; |
- } |
- if (replacement != null) { |
- if (result == null) result = new StringBuffer(); |
- if (i > start) result.write(text.substring(start, i)); |
- result.write(replacement); |
- start = i + 1; |
- } |
- } |
- if (result == null) return null; |
- if (end > start) result.write(text.substring(start, end)); |
- return result.toString(); |
- } |
- |
- StringConversionSink startChunkedConversion(Sink<String> sink) { |
- if (sink is! StringConversionSink) { |
- sink = new StringConversionSink.from(sink); |
- } |
- return new _HtmlEscapeSink(this, sink); |
- } |
-} |
- |
-class _HtmlEscapeSink extends StringConversionSinkBase { |
- final HtmlEscape _escape; |
- final StringConversionSink _sink; |
- |
- _HtmlEscapeSink(this._escape, this._sink); |
- |
- void addSlice(String chunk, int start, int end, bool isLast) { |
- var val = _escape._convert(chunk, start, end); |
- if(val == null) { |
- _sink.addSlice(chunk, start, end, isLast); |
- } else { |
- _sink.add(val); |
- if (isLast) _sink.close(); |
- } |
- } |
- |
- void close() { _sink.close(); } |
-} |