MD Settings: change outlinks to actually use <a>

chrome/browser/resources/settings/appearance_page/appearance_page.js

Index: chrome/browser/resources/settings/appearance_page/appearance_page.js
diff --git a/chrome/browser/resources/settings/appearance_page/appearance_page.js b/chrome/browser/resources/settings/appearance_page/appearance_page.js
index 9039741b3736e81b204bfe2cd4a79ab3e86168c7..7b9a71ec4eb115c9e4174f7c3063d529f56ee62e 100644
--- a/chrome/browser/resources/settings/appearance_page/appearance_page.js
+++ b/chrome/browser/resources/settings/appearance_page/appearance_page.js
@@ -85,6 +85,9 @@ Polymer({
     themeSublabel_: String,
 
     /** @private */
+    themeUrl_: String,
+
+    /** @private */
     useSystemTheme_: {
       type: Boolean,
       value: false,  // Can only be true on Linux, but value exists everywhere.
@@ -106,9 +109,6 @@ Polymer({
   /** @private {?settings.AppearanceBrowserProxy} */
   browserProxy_: null,
 
-  /** @private {string} */
-  themeUrl_: '',
-
   observers: [
     'themeChanged_(prefs.extensions.theme.id.value, useSystemTheme_)',
 
@@ -166,8 +166,8 @@ Polymer({
   },
 
   /** @private */

[dschuyler, 2017/04/18 23:22:44]

comment like, "URL for either current theme or the theme gallery."

@return {string}

[scottchen, 2017/04/20 18:41:49]

Acknowledged.

-  onThemesTap_: function() {
-    window.open(this.themeUrl_ || loadTimeData.getString('themesGalleryUrl'));
+  getThemeHref_: function() {
+    return this.themeUrl_ || loadTimeData.getString('themesGalleryUrl');

[scottchen, 2017/04/18 19:12:49]

this.themeUrl_ contains a generated themes id, so I checked for potential XXS
and don't think it's possible with the id that gets returned from our C++ code.

But just to be safe, can a reviewer confirm if you know for sure?

[dpapad, 2017/04/18 21:29:27]

+dbeam: Should we be using
https://cs.chromium.org/chromium/src/ui/webui/resources/js/parse_html_subset....,
or some other way to escape the URL here?

[Dan Beam, 2017/04/18 21:59:49]

i wouldn't worry about it

if you realllly want to:
https://gist.github.com/danbeam/fc99e28f48b6696ddf9d13176fee3c61

[scottchen, 2017/04/18 22:41:51]

Acknowledged.

   },
 
   // <if expr="chromeos">