Added compiled JavaScript to repository for GitHub pages
This feels like a mistake...
This commit is contained in:
parent
3d5a2fb322
commit
dc226b1f25
468 changed files with 212152 additions and 2 deletions
948
resources/public/js/compiled/out/goog/html/safehtml.js
Normal file
948
resources/public/js/compiled/out/goog/html/safehtml.js
Normal file
|
|
@ -0,0 +1,948 @@
|
|||
// Copyright 2013 The Closure Library Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS-IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
|
||||
/**
|
||||
* @fileoverview The SafeHtml type and its builders.
|
||||
*
|
||||
* TODO(xtof): Link to document stating type contract.
|
||||
*/
|
||||
|
||||
goog.provide('goog.html.SafeHtml');
|
||||
|
||||
goog.require('goog.array');
|
||||
goog.require('goog.asserts');
|
||||
goog.require('goog.dom.TagName');
|
||||
goog.require('goog.dom.tags');
|
||||
goog.require('goog.html.SafeStyle');
|
||||
goog.require('goog.html.SafeStyleSheet');
|
||||
goog.require('goog.html.SafeUrl');
|
||||
goog.require('goog.html.TrustedResourceUrl');
|
||||
goog.require('goog.i18n.bidi.Dir');
|
||||
goog.require('goog.i18n.bidi.DirectionalString');
|
||||
goog.require('goog.labs.userAgent.browser');
|
||||
goog.require('goog.object');
|
||||
goog.require('goog.string');
|
||||
goog.require('goog.string.Const');
|
||||
goog.require('goog.string.TypedString');
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* A string that is safe to use in HTML context in DOM APIs and HTML documents.
|
||||
*
|
||||
* A SafeHtml is a string-like object that carries the security type contract
|
||||
* that its value as a string will not cause untrusted script execution when
|
||||
* evaluated as HTML in a browser.
|
||||
*
|
||||
* Values of this type are guaranteed to be safe to use in HTML contexts,
|
||||
* such as, assignment to the innerHTML DOM property, or interpolation into
|
||||
* a HTML template in HTML PC_DATA context, in the sense that the use will not
|
||||
* result in a Cross-Site-Scripting vulnerability.
|
||||
*
|
||||
* Instances of this type must be created via the factory methods
|
||||
* ({@code goog.html.SafeHtml.create}, {@code goog.html.SafeHtml.htmlEscape}),
|
||||
* etc and not by invoking its constructor. The constructor intentionally
|
||||
* takes no parameters and the type is immutable; hence only a default instance
|
||||
* corresponding to the empty string can be obtained via constructor invocation.
|
||||
*
|
||||
* @see goog.html.SafeHtml#create
|
||||
* @see goog.html.SafeHtml#htmlEscape
|
||||
* @constructor
|
||||
* @final
|
||||
* @struct
|
||||
* @implements {goog.i18n.bidi.DirectionalString}
|
||||
* @implements {goog.string.TypedString}
|
||||
*/
|
||||
goog.html.SafeHtml = function() {
|
||||
/**
|
||||
* The contained value of this SafeHtml. The field has a purposely ugly
|
||||
* name to make (non-compiled) code that attempts to directly access this
|
||||
* field stand out.
|
||||
* @private {string}
|
||||
*/
|
||||
this.privateDoNotAccessOrElseSafeHtmlWrappedValue_ = '';
|
||||
|
||||
/**
|
||||
* A type marker used to implement additional run-time type checking.
|
||||
* @see goog.html.SafeHtml#unwrap
|
||||
* @const
|
||||
* @private
|
||||
*/
|
||||
this.SAFE_HTML_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ =
|
||||
goog.html.SafeHtml.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_;
|
||||
|
||||
/**
|
||||
* This SafeHtml's directionality, or null if unknown.
|
||||
* @private {?goog.i18n.bidi.Dir}
|
||||
*/
|
||||
this.dir_ = null;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @override
|
||||
* @const
|
||||
*/
|
||||
goog.html.SafeHtml.prototype.implementsGoogI18nBidiDirectionalString = true;
|
||||
|
||||
|
||||
/** @override */
|
||||
goog.html.SafeHtml.prototype.getDirection = function() {
|
||||
return this.dir_;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @override
|
||||
* @const
|
||||
*/
|
||||
goog.html.SafeHtml.prototype.implementsGoogStringTypedString = true;
|
||||
|
||||
|
||||
/**
|
||||
* Returns this SafeHtml's value as string.
|
||||
*
|
||||
* IMPORTANT: In code where it is security relevant that an object's type is
|
||||
* indeed {@code SafeHtml}, use {@code goog.html.SafeHtml.unwrap} instead of
|
||||
* this method. If in doubt, assume that it's security relevant. In particular,
|
||||
* note that goog.html functions which return a goog.html type do not guarantee
|
||||
* that the returned instance is of the right type. For example:
|
||||
*
|
||||
* <pre>
|
||||
* var fakeSafeHtml = new String('fake');
|
||||
* fakeSafeHtml.__proto__ = goog.html.SafeHtml.prototype;
|
||||
* var newSafeHtml = goog.html.SafeHtml.htmlEscape(fakeSafeHtml);
|
||||
* // newSafeHtml is just an alias for fakeSafeHtml, it's passed through by
|
||||
* // goog.html.SafeHtml.htmlEscape() as fakeSafeHtml
|
||||
* // instanceof goog.html.SafeHtml.
|
||||
* </pre>
|
||||
*
|
||||
* @see goog.html.SafeHtml#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeHtml.prototype.getTypedStringValue = function() {
|
||||
return this.privateDoNotAccessOrElseSafeHtmlWrappedValue_;
|
||||
};
|
||||
|
||||
|
||||
if (goog.DEBUG) {
|
||||
/**
|
||||
* Returns a debug string-representation of this value.
|
||||
*
|
||||
* To obtain the actual string value wrapped in a SafeHtml, use
|
||||
* {@code goog.html.SafeHtml.unwrap}.
|
||||
*
|
||||
* @see goog.html.SafeHtml#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeHtml.prototype.toString = function() {
|
||||
return 'SafeHtml{' + this.privateDoNotAccessOrElseSafeHtmlWrappedValue_ +
|
||||
'}';
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Performs a runtime check that the provided object is indeed a SafeHtml
|
||||
* object, and returns its value.
|
||||
* @param {!goog.html.SafeHtml} safeHtml The object to extract from.
|
||||
* @return {string} The SafeHtml object's contained string, unless the run-time
|
||||
* type check fails. In that case, {@code unwrap} returns an innocuous
|
||||
* string, or, if assertions are enabled, throws
|
||||
* {@code goog.asserts.AssertionError}.
|
||||
*/
|
||||
goog.html.SafeHtml.unwrap = function(safeHtml) {
|
||||
// Perform additional run-time type-checking to ensure that safeHtml is indeed
|
||||
// an instance of the expected type. This provides some additional protection
|
||||
// against security bugs due to application code that disables type checks.
|
||||
// Specifically, the following checks are performed:
|
||||
// 1. The object is an instance of the expected type.
|
||||
// 2. The object is not an instance of a subclass.
|
||||
// 3. The object carries a type marker for the expected type. "Faking" an
|
||||
// object requires a reference to the type marker, which has names intended
|
||||
// to stand out in code reviews.
|
||||
if (safeHtml instanceof goog.html.SafeHtml &&
|
||||
safeHtml.constructor === goog.html.SafeHtml &&
|
||||
safeHtml.SAFE_HTML_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ ===
|
||||
goog.html.SafeHtml.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_) {
|
||||
return safeHtml.privateDoNotAccessOrElseSafeHtmlWrappedValue_;
|
||||
} else {
|
||||
goog.asserts.fail('expected object of type SafeHtml, got \'' +
|
||||
safeHtml + '\' of type ' + goog.typeOf(safeHtml));
|
||||
return 'type_error:SafeHtml';
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Shorthand for union of types that can sensibly be converted to strings
|
||||
* or might already be SafeHtml (as SafeHtml is a goog.string.TypedString).
|
||||
* @private
|
||||
* @typedef {string|number|boolean|!goog.string.TypedString|
|
||||
* !goog.i18n.bidi.DirectionalString}
|
||||
*/
|
||||
goog.html.SafeHtml.TextOrHtml_;
|
||||
|
||||
|
||||
/**
|
||||
* Returns HTML-escaped text as a SafeHtml object.
|
||||
*
|
||||
* If text is of a type that implements
|
||||
* {@code goog.i18n.bidi.DirectionalString}, the directionality of the new
|
||||
* {@code SafeHtml} object is set to {@code text}'s directionality, if known.
|
||||
* Otherwise, the directionality of the resulting SafeHtml is unknown (i.e.,
|
||||
* {@code null}).
|
||||
*
|
||||
* @param {!goog.html.SafeHtml.TextOrHtml_} textOrHtml The text to escape. If
|
||||
* the parameter is of type SafeHtml it is returned directly (no escaping
|
||||
* is done).
|
||||
* @return {!goog.html.SafeHtml} The escaped text, wrapped as a SafeHtml.
|
||||
*/
|
||||
goog.html.SafeHtml.htmlEscape = function(textOrHtml) {
|
||||
if (textOrHtml instanceof goog.html.SafeHtml) {
|
||||
return textOrHtml;
|
||||
}
|
||||
var dir = null;
|
||||
if (textOrHtml.implementsGoogI18nBidiDirectionalString) {
|
||||
dir = textOrHtml.getDirection();
|
||||
}
|
||||
var textAsString;
|
||||
if (textOrHtml.implementsGoogStringTypedString) {
|
||||
textAsString = textOrHtml.getTypedStringValue();
|
||||
} else {
|
||||
textAsString = String(textOrHtml);
|
||||
}
|
||||
return goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse(
|
||||
goog.string.htmlEscape(textAsString), dir);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Returns HTML-escaped text as a SafeHtml object, with newlines changed to
|
||||
* <br>.
|
||||
* @param {!goog.html.SafeHtml.TextOrHtml_} textOrHtml The text to escape. If
|
||||
* the parameter is of type SafeHtml it is returned directly (no escaping
|
||||
* is done).
|
||||
* @return {!goog.html.SafeHtml} The escaped text, wrapped as a SafeHtml.
|
||||
*/
|
||||
goog.html.SafeHtml.htmlEscapePreservingNewlines = function(textOrHtml) {
|
||||
if (textOrHtml instanceof goog.html.SafeHtml) {
|
||||
return textOrHtml;
|
||||
}
|
||||
var html = goog.html.SafeHtml.htmlEscape(textOrHtml);
|
||||
return goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse(
|
||||
goog.string.newLineToBr(goog.html.SafeHtml.unwrap(html)),
|
||||
html.getDirection());
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Returns HTML-escaped text as a SafeHtml object, with newlines changed to
|
||||
* <br> and escaping whitespace to preserve spatial formatting. Character
|
||||
* entity #160 is used to make it safer for XML.
|
||||
* @param {!goog.html.SafeHtml.TextOrHtml_} textOrHtml The text to escape. If
|
||||
* the parameter is of type SafeHtml it is returned directly (no escaping
|
||||
* is done).
|
||||
* @return {!goog.html.SafeHtml} The escaped text, wrapped as a SafeHtml.
|
||||
*/
|
||||
goog.html.SafeHtml.htmlEscapePreservingNewlinesAndSpaces = function(
|
||||
textOrHtml) {
|
||||
if (textOrHtml instanceof goog.html.SafeHtml) {
|
||||
return textOrHtml;
|
||||
}
|
||||
var html = goog.html.SafeHtml.htmlEscape(textOrHtml);
|
||||
return goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse(
|
||||
goog.string.whitespaceEscape(goog.html.SafeHtml.unwrap(html)),
|
||||
html.getDirection());
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Coerces an arbitrary object into a SafeHtml object.
|
||||
*
|
||||
* If {@code textOrHtml} is already of type {@code goog.html.SafeHtml}, the same
|
||||
* object is returned. Otherwise, {@code textOrHtml} is coerced to string, and
|
||||
* HTML-escaped. If {@code textOrHtml} is of a type that implements
|
||||
* {@code goog.i18n.bidi.DirectionalString}, its directionality, if known, is
|
||||
* preserved.
|
||||
*
|
||||
* @param {!goog.html.SafeHtml.TextOrHtml_} textOrHtml The text or SafeHtml to
|
||||
* coerce.
|
||||
* @return {!goog.html.SafeHtml} The resulting SafeHtml object.
|
||||
* @deprecated Use goog.html.SafeHtml.htmlEscape.
|
||||
*/
|
||||
goog.html.SafeHtml.from = goog.html.SafeHtml.htmlEscape;
|
||||
|
||||
|
||||
/**
|
||||
* @const
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeHtml.VALID_NAMES_IN_TAG_ = /^[a-zA-Z0-9-]+$/;
|
||||
|
||||
|
||||
/**
|
||||
* Set of attributes containing URL as defined at
|
||||
* http://www.w3.org/TR/html5/index.html#attributes-1.
|
||||
* @private @const {!Object<string,boolean>}
|
||||
*/
|
||||
goog.html.SafeHtml.URL_ATTRIBUTES_ = goog.object.createSet(
|
||||
'action', 'cite', 'data', 'formaction', 'href', 'manifest', 'poster',
|
||||
'src');
|
||||
|
||||
|
||||
/**
|
||||
* Tags which are unsupported via create(). They might be supported via a
|
||||
* tag-specific create method. These are tags which might require a
|
||||
* TrustedResourceUrl in one of their attributes or a restricted type for
|
||||
* their content.
|
||||
* @private @const {!Object<string,boolean>}
|
||||
*/
|
||||
goog.html.SafeHtml.NOT_ALLOWED_TAG_NAMES_ = goog.object.createSet(
|
||||
goog.dom.TagName.APPLET, goog.dom.TagName.BASE, goog.dom.TagName.EMBED,
|
||||
goog.dom.TagName.IFRAME, goog.dom.TagName.LINK, goog.dom.TagName.MATH,
|
||||
goog.dom.TagName.META, goog.dom.TagName.OBJECT, goog.dom.TagName.SCRIPT,
|
||||
goog.dom.TagName.STYLE, goog.dom.TagName.SVG, goog.dom.TagName.TEMPLATE);
|
||||
|
||||
|
||||
/**
|
||||
* @typedef {string|number|goog.string.TypedString|
|
||||
* goog.html.SafeStyle.PropertyMap}
|
||||
*/
|
||||
goog.html.SafeHtml.AttributeValue;
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeHtml content consisting of a tag with optional attributes and
|
||||
* optional content.
|
||||
*
|
||||
* For convenience tag names and attribute names are accepted as regular
|
||||
* strings, instead of goog.string.Const. Nevertheless, you should not pass
|
||||
* user-controlled values to these parameters. Note that these parameters are
|
||||
* syntactically validated at runtime, and invalid values will result in
|
||||
* an exception.
|
||||
*
|
||||
* Example usage:
|
||||
*
|
||||
* goog.html.SafeHtml.create('br');
|
||||
* goog.html.SafeHtml.create('div', {'class': 'a'});
|
||||
* goog.html.SafeHtml.create('p', {}, 'a');
|
||||
* goog.html.SafeHtml.create('p', {}, goog.html.SafeHtml.create('br'));
|
||||
*
|
||||
* goog.html.SafeHtml.create('span', {
|
||||
* 'style': {'margin': '0'}
|
||||
* });
|
||||
*
|
||||
* To guarantee SafeHtml's type contract is upheld there are restrictions on
|
||||
* attribute values and tag names.
|
||||
*
|
||||
* - For attributes which contain script code (on*), a goog.string.Const is
|
||||
* required.
|
||||
* - For attributes which contain style (style), a goog.html.SafeStyle or a
|
||||
* goog.html.SafeStyle.PropertyMap is required.
|
||||
* - For attributes which are interpreted as URLs (e.g. src, href) a
|
||||
* goog.html.SafeUrl, goog.string.Const or string is required. If a string
|
||||
* is passed, it will be sanitized with SafeUrl.sanitize().
|
||||
* - For tags which can load code or set security relevant page metadata,
|
||||
* more specific goog.html.SafeHtml.create*() functions must be used. Tags
|
||||
* which are not supported by this function are applet, base, embed, iframe,
|
||||
* link, math, object, script, style, svg, and template.
|
||||
*
|
||||
* @param {string} tagName The name of the tag. Only tag names consisting of
|
||||
* [a-zA-Z0-9-] are allowed. Tag names documented above are disallowed.
|
||||
* @param {?Object<string, ?goog.html.SafeHtml.AttributeValue>=} opt_attributes
|
||||
* Mapping from attribute names to their values. Only attribute names
|
||||
* consisting of [a-zA-Z0-9-] are allowed. Value of null or undefined causes
|
||||
* the attribute to be omitted.
|
||||
* @param {!goog.html.SafeHtml.TextOrHtml_|
|
||||
* !Array<!goog.html.SafeHtml.TextOrHtml_>=} opt_content Content to
|
||||
* HTML-escape and put inside the tag. This must be empty for void tags
|
||||
* like <br>. Array elements are concatenated.
|
||||
* @return {!goog.html.SafeHtml} The SafeHtml content with the tag.
|
||||
* @throws {Error} If invalid tag name, attribute name, or attribute value is
|
||||
* provided.
|
||||
* @throws {goog.asserts.AssertionError} If content for void tag is provided.
|
||||
*/
|
||||
goog.html.SafeHtml.create = function(tagName, opt_attributes, opt_content) {
|
||||
goog.html.SafeHtml.verifyTagName(tagName);
|
||||
return goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse(
|
||||
tagName, opt_attributes, opt_content);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Verifies if the tag name is valid and if it doesn't change the context.
|
||||
* E.g. STRONG is fine but SCRIPT throws because it changes context. See
|
||||
* goog.html.SafeHtml.create for an explanation of allowed tags.
|
||||
* @param {string} tagName
|
||||
* @throws {Error} If invalid tag name is provided.
|
||||
* @package
|
||||
*/
|
||||
goog.html.SafeHtml.verifyTagName = function(tagName) {
|
||||
if (!goog.html.SafeHtml.VALID_NAMES_IN_TAG_.test(tagName)) {
|
||||
throw Error('Invalid tag name <' + tagName + '>.');
|
||||
}
|
||||
if (tagName.toUpperCase() in goog.html.SafeHtml.NOT_ALLOWED_TAG_NAMES_) {
|
||||
throw Error('Tag name <' + tagName + '> is not allowed for SafeHtml.');
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeHtml representing an iframe tag.
|
||||
*
|
||||
* This by default restricts the iframe as much as possible by setting the
|
||||
* sandbox attribute to the empty string. If the iframe requires less
|
||||
* restrictions, set the sandbox attribute as tight as possible, but do not rely
|
||||
* on the sandbox as a security feature because it is not supported by older
|
||||
* browsers. If a sandbox is essential to security (e.g. for third-party
|
||||
* frames), use createSandboxIframe which checks for browser support.
|
||||
*
|
||||
* @see https://developer.mozilla.org/en/docs/Web/HTML/Element/iframe#attr-sandbox
|
||||
*
|
||||
* @param {?goog.html.TrustedResourceUrl=} opt_src The value of the src
|
||||
* attribute. If null or undefined src will not be set.
|
||||
* @param {?goog.html.SafeHtml=} opt_srcdoc The value of the srcdoc attribute.
|
||||
* If null or undefined srcdoc will not be set.
|
||||
* @param {?Object<string, ?goog.html.SafeHtml.AttributeValue>=} opt_attributes
|
||||
* Mapping from attribute names to their values. Only attribute names
|
||||
* consisting of [a-zA-Z0-9-] are allowed. Value of null or undefined causes
|
||||
* the attribute to be omitted.
|
||||
* @param {!goog.html.SafeHtml.TextOrHtml_|
|
||||
* !Array<!goog.html.SafeHtml.TextOrHtml_>=} opt_content Content to
|
||||
* HTML-escape and put inside the tag. Array elements are concatenated.
|
||||
* @return {!goog.html.SafeHtml} The SafeHtml content with the tag.
|
||||
* @throws {Error} If invalid tag name, attribute name, or attribute value is
|
||||
* provided. If opt_attributes contains the src or srcdoc attributes.
|
||||
*/
|
||||
goog.html.SafeHtml.createIframe = function(
|
||||
opt_src, opt_srcdoc, opt_attributes, opt_content) {
|
||||
if (opt_src) {
|
||||
// Check whether this is really TrustedResourceUrl.
|
||||
goog.html.TrustedResourceUrl.unwrap(opt_src);
|
||||
}
|
||||
|
||||
var fixedAttributes = {};
|
||||
fixedAttributes['src'] = opt_src || null;
|
||||
fixedAttributes['srcdoc'] =
|
||||
opt_srcdoc && goog.html.SafeHtml.unwrap(opt_srcdoc);
|
||||
var defaultAttributes = {'sandbox': ''};
|
||||
var attributes = goog.html.SafeHtml.combineAttributes(
|
||||
fixedAttributes, defaultAttributes, opt_attributes);
|
||||
return goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse(
|
||||
'iframe', attributes, opt_content);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeHtml representing a sandboxed iframe tag.
|
||||
*
|
||||
* The sandbox attribute is enforced in its most restrictive mode, an empty
|
||||
* string. Consequently, the security requirements for the src and srcdoc
|
||||
* attributes are relaxed compared to SafeHtml.createIframe. This function
|
||||
* will throw on browsers that do not support the sandbox attribute, as
|
||||
* determined by SafeHtml.canUseSandboxIframe.
|
||||
*
|
||||
* The SafeHtml returned by this function can trigger downloads with no
|
||||
* user interaction on Chrome (though only a few, further attempts are blocked).
|
||||
* Firefox and IE will block all downloads from the sandbox.
|
||||
*
|
||||
* @see https://developer.mozilla.org/en/docs/Web/HTML/Element/iframe#attr-sandbox
|
||||
* @see https://lists.w3.org/Archives/Public/public-whatwg-archive/2013Feb/0112.html
|
||||
*
|
||||
* @param {string|!goog.html.SafeUrl=} opt_src The value of the src
|
||||
* attribute. If null or undefined src will not be set.
|
||||
* @param {string=} opt_srcdoc The value of the srcdoc attribute.
|
||||
* If null or undefined srcdoc will not be set. Will not be sanitized.
|
||||
* @param {!Object<string, ?goog.html.SafeHtml.AttributeValue>=} opt_attributes
|
||||
* Mapping from attribute names to their values. Only attribute names
|
||||
* consisting of [a-zA-Z0-9-] are allowed. Value of null or undefined causes
|
||||
* the attribute to be omitted.
|
||||
* @param {!goog.html.SafeHtml.TextOrHtml_|
|
||||
* !Array<!goog.html.SafeHtml.TextOrHtml_>=} opt_content Content to
|
||||
* HTML-escape and put inside the tag. Array elements are concatenated.
|
||||
* @return {!goog.html.SafeHtml} The SafeHtml content with the tag.
|
||||
* @throws {Error} If invalid tag name, attribute name, or attribute value is
|
||||
* provided. If opt_attributes contains the src, srcdoc or sandbox
|
||||
* attributes. If browser does not support the sandbox attribute on iframe.
|
||||
*/
|
||||
goog.html.SafeHtml.createSandboxIframe = function(
|
||||
opt_src, opt_srcdoc, opt_attributes, opt_content) {
|
||||
if (!goog.html.SafeHtml.canUseSandboxIframe()) {
|
||||
throw new Error('The browser does not support sandboxed iframes.');
|
||||
}
|
||||
|
||||
var fixedAttributes = {};
|
||||
if (opt_src) {
|
||||
// Note that sanitize is a no-op on SafeUrl.
|
||||
fixedAttributes['src'] =
|
||||
goog.html.SafeUrl.unwrap(goog.html.SafeUrl.sanitize(opt_src));
|
||||
} else {
|
||||
fixedAttributes['src'] = null;
|
||||
}
|
||||
fixedAttributes['srcdoc'] = opt_srcdoc || null;
|
||||
fixedAttributes['sandbox'] = '';
|
||||
var attributes =
|
||||
goog.html.SafeHtml.combineAttributes(fixedAttributes, {}, opt_attributes);
|
||||
return goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse(
|
||||
'iframe', attributes, opt_content);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Checks if the user agent supports sandboxed iframes.
|
||||
* @return {boolean}
|
||||
*/
|
||||
goog.html.SafeHtml.canUseSandboxIframe = function() {
|
||||
return goog.global['HTMLIFrameElement'] &&
|
||||
('sandbox' in goog.global['HTMLIFrameElement'].prototype);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeHtml representing a script tag with the src attribute.
|
||||
* @param {!goog.html.TrustedResourceUrl} src The value of the src
|
||||
* attribute.
|
||||
* @param {?Object<string, ?goog.html.SafeHtml.AttributeValue>=}
|
||||
* opt_attributes
|
||||
* Mapping from attribute names to their values. Only attribute names
|
||||
* consisting of [a-zA-Z0-9-] are allowed. Value of null or undefined
|
||||
* causes the attribute to be omitted.
|
||||
* @return {!goog.html.SafeHtml} The SafeHtml content with the tag.
|
||||
* @throws {Error} If invalid attribute name or value is provided. If
|
||||
* opt_attributes contains the src attribute.
|
||||
*/
|
||||
goog.html.SafeHtml.createScriptSrc = function(src, opt_attributes) {
|
||||
// Check whether this is really TrustedResourceUrl.
|
||||
goog.html.TrustedResourceUrl.unwrap(src);
|
||||
|
||||
var fixedAttributes = {'src': src};
|
||||
var defaultAttributes = {};
|
||||
var attributes = goog.html.SafeHtml.combineAttributes(
|
||||
fixedAttributes, defaultAttributes, opt_attributes);
|
||||
return goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse(
|
||||
'script', attributes);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeHtml representing a style tag. The type attribute is set
|
||||
* to "text/css".
|
||||
* @param {!goog.html.SafeStyleSheet|!Array<!goog.html.SafeStyleSheet>}
|
||||
* styleSheet Content to put inside the tag. Array elements are
|
||||
* concatenated.
|
||||
* @param {?Object<string, ?goog.html.SafeHtml.AttributeValue>=} opt_attributes
|
||||
* Mapping from attribute names to their values. Only attribute names
|
||||
* consisting of [a-zA-Z0-9-] are allowed. Value of null or undefined causes
|
||||
* the attribute to be omitted.
|
||||
* @return {!goog.html.SafeHtml} The SafeHtml content with the tag.
|
||||
* @throws {Error} If invalid attribute name or attribute value is provided. If
|
||||
* opt_attributes contains the type attribute.
|
||||
*/
|
||||
goog.html.SafeHtml.createStyle = function(styleSheet, opt_attributes) {
|
||||
var fixedAttributes = {'type': 'text/css'};
|
||||
var defaultAttributes = {};
|
||||
var attributes = goog.html.SafeHtml.combineAttributes(
|
||||
fixedAttributes, defaultAttributes, opt_attributes);
|
||||
|
||||
var content = '';
|
||||
styleSheet = goog.array.concat(styleSheet);
|
||||
for (var i = 0; i < styleSheet.length; i++) {
|
||||
content += goog.html.SafeStyleSheet.unwrap(styleSheet[i]);
|
||||
}
|
||||
// Convert to SafeHtml so that it's not HTML-escaped. This is safe because
|
||||
// as part of its contract, SafeStyleSheet should have no dangerous '<'.
|
||||
var htmlContent =
|
||||
goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse(
|
||||
content, goog.i18n.bidi.Dir.NEUTRAL);
|
||||
return goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse(
|
||||
'style', attributes, htmlContent);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeHtml representing a meta refresh tag.
|
||||
* @param {!goog.html.SafeUrl|string} url Where to redirect. If a string is
|
||||
* passed, it will be sanitized with SafeUrl.sanitize().
|
||||
* @param {number=} opt_secs Number of seconds until the page should be
|
||||
* reloaded. Will be set to 0 if unspecified.
|
||||
* @return {!goog.html.SafeHtml} The SafeHtml content with the tag.
|
||||
*/
|
||||
goog.html.SafeHtml.createMetaRefresh = function(url, opt_secs) {
|
||||
|
||||
// Note that sanitize is a no-op on SafeUrl.
|
||||
var unwrappedUrl = goog.html.SafeUrl.unwrap(goog.html.SafeUrl.sanitize(url));
|
||||
|
||||
if (goog.labs.userAgent.browser.isIE() ||
|
||||
goog.labs.userAgent.browser.isEdge()) {
|
||||
// IE/EDGE can't parse the content attribute if the url contains a
|
||||
// semicolon. We can fix this by adding quotes around the url, but then we
|
||||
// can't parse quotes in the URL correctly. Also, it seems that IE/EDGE
|
||||
// did not unescape semicolons in these URLs at some point in the past. We
|
||||
// take a best-effort approach.
|
||||
//
|
||||
// If the URL has semicolons (which may happen in some cases, see
|
||||
// http://www.w3.org/TR/1999/REC-html401-19991224/appendix/notes.html#h-B.2
|
||||
// for instance), wrap it in single quotes to protect the semicolons.
|
||||
// If the URL has semicolons and single quotes, url-encode the single quotes
|
||||
// as well.
|
||||
//
|
||||
// This is imperfect. Notice that both ' and ; are reserved characters in
|
||||
// URIs, so this could do the wrong thing, but at least it will do the wrong
|
||||
// thing in only rare cases.
|
||||
if (goog.string.contains(unwrappedUrl, ';')) {
|
||||
unwrappedUrl = "'" + unwrappedUrl.replace(/'/g, '%27') + "'";
|
||||
}
|
||||
}
|
||||
var attributes = {
|
||||
'http-equiv': 'refresh',
|
||||
'content': (opt_secs || 0) + '; url=' + unwrappedUrl
|
||||
};
|
||||
|
||||
// This function will handle the HTML escaping for attributes.
|
||||
return goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse(
|
||||
'meta', attributes);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @param {string} tagName The tag name.
|
||||
* @param {string} name The attribute name.
|
||||
* @param {!goog.html.SafeHtml.AttributeValue} value The attribute value.
|
||||
* @return {string} A "name=value" string.
|
||||
* @throws {Error} If attribute value is unsafe for the given tag and attribute.
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeHtml.getAttrNameAndValue_ = function(tagName, name, value) {
|
||||
// If it's goog.string.Const, allow any valid attribute name.
|
||||
if (value instanceof goog.string.Const) {
|
||||
value = goog.string.Const.unwrap(value);
|
||||
} else if (name.toLowerCase() == 'style') {
|
||||
value = goog.html.SafeHtml.getStyleValue_(value);
|
||||
} else if (/^on/i.test(name)) {
|
||||
// TODO(jakubvrana): Disallow more attributes with a special meaning.
|
||||
throw Error(
|
||||
'Attribute "' + name + '" requires goog.string.Const value, "' + value +
|
||||
'" given.');
|
||||
// URL attributes handled differently accroding to tag.
|
||||
} else if (name.toLowerCase() in goog.html.SafeHtml.URL_ATTRIBUTES_) {
|
||||
if (value instanceof goog.html.TrustedResourceUrl) {
|
||||
value = goog.html.TrustedResourceUrl.unwrap(value);
|
||||
} else if (value instanceof goog.html.SafeUrl) {
|
||||
value = goog.html.SafeUrl.unwrap(value);
|
||||
} else if (goog.isString(value)) {
|
||||
value = goog.html.SafeUrl.sanitize(value).getTypedStringValue();
|
||||
} else {
|
||||
throw Error(
|
||||
'Attribute "' + name + '" on tag "' + tagName +
|
||||
'" requires goog.html.SafeUrl, goog.string.Const, or string,' +
|
||||
' value "' + value + '" given.');
|
||||
}
|
||||
}
|
||||
|
||||
// Accept SafeUrl, TrustedResourceUrl, etc. for attributes which only require
|
||||
// HTML-escaping.
|
||||
if (value.implementsGoogStringTypedString) {
|
||||
// Ok to call getTypedStringValue() since there's no reliance on the type
|
||||
// contract for security here.
|
||||
value = value.getTypedStringValue();
|
||||
}
|
||||
|
||||
goog.asserts.assert(
|
||||
goog.isString(value) || goog.isNumber(value),
|
||||
'String or number value expected, got ' + (typeof value) +
|
||||
' with value: ' + value);
|
||||
return name + '="' + goog.string.htmlEscape(String(value)) + '"';
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Gets value allowed in "style" attribute.
|
||||
* @param {!goog.html.SafeHtml.AttributeValue} value It could be SafeStyle or a
|
||||
* map which will be passed to goog.html.SafeStyle.create.
|
||||
* @return {string} Unwrapped value.
|
||||
* @throws {Error} If string value is given.
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeHtml.getStyleValue_ = function(value) {
|
||||
if (!goog.isObject(value)) {
|
||||
throw Error(
|
||||
'The "style" attribute requires goog.html.SafeStyle or map ' +
|
||||
'of style properties, ' + (typeof value) + ' given: ' + value);
|
||||
}
|
||||
if (!(value instanceof goog.html.SafeStyle)) {
|
||||
// Process the property bag into a style object.
|
||||
value = goog.html.SafeStyle.create(value);
|
||||
}
|
||||
return goog.html.SafeStyle.unwrap(value);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeHtml content with known directionality consisting of a tag with
|
||||
* optional attributes and optional content.
|
||||
* @param {!goog.i18n.bidi.Dir} dir Directionality.
|
||||
* @param {string} tagName
|
||||
* @param {?Object<string, ?goog.html.SafeHtml.AttributeValue>=} opt_attributes
|
||||
* @param {!goog.html.SafeHtml.TextOrHtml_|
|
||||
* !Array<!goog.html.SafeHtml.TextOrHtml_>=} opt_content
|
||||
* @return {!goog.html.SafeHtml} The SafeHtml content with the tag.
|
||||
*/
|
||||
goog.html.SafeHtml.createWithDir = function(
|
||||
dir, tagName, opt_attributes, opt_content) {
|
||||
var html = goog.html.SafeHtml.create(tagName, opt_attributes, opt_content);
|
||||
html.dir_ = dir;
|
||||
return html;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a new SafeHtml object by concatenating values.
|
||||
* @param {...(!goog.html.SafeHtml.TextOrHtml_|
|
||||
* !Array<!goog.html.SafeHtml.TextOrHtml_>)} var_args Values to concatenate.
|
||||
* @return {!goog.html.SafeHtml}
|
||||
*/
|
||||
goog.html.SafeHtml.concat = function(var_args) {
|
||||
var dir = goog.i18n.bidi.Dir.NEUTRAL;
|
||||
var content = '';
|
||||
|
||||
/**
|
||||
* @param {!goog.html.SafeHtml.TextOrHtml_|
|
||||
* !Array<!goog.html.SafeHtml.TextOrHtml_>} argument
|
||||
*/
|
||||
var addArgument = function(argument) {
|
||||
if (goog.isArray(argument)) {
|
||||
goog.array.forEach(argument, addArgument);
|
||||
} else {
|
||||
var html = goog.html.SafeHtml.htmlEscape(argument);
|
||||
content += goog.html.SafeHtml.unwrap(html);
|
||||
var htmlDir = html.getDirection();
|
||||
if (dir == goog.i18n.bidi.Dir.NEUTRAL) {
|
||||
dir = htmlDir;
|
||||
} else if (htmlDir != goog.i18n.bidi.Dir.NEUTRAL && dir != htmlDir) {
|
||||
dir = null;
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
goog.array.forEach(arguments, addArgument);
|
||||
return goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse(
|
||||
content, dir);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a new SafeHtml object with known directionality by concatenating the
|
||||
* values.
|
||||
* @param {!goog.i18n.bidi.Dir} dir Directionality.
|
||||
* @param {...(!goog.html.SafeHtml.TextOrHtml_|
|
||||
* !Array<!goog.html.SafeHtml.TextOrHtml_>)} var_args Elements of array
|
||||
* arguments would be processed recursively.
|
||||
* @return {!goog.html.SafeHtml}
|
||||
*/
|
||||
goog.html.SafeHtml.concatWithDir = function(dir, var_args) {
|
||||
var html = goog.html.SafeHtml.concat(goog.array.slice(arguments, 1));
|
||||
html.dir_ = dir;
|
||||
return html;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Type marker for the SafeHtml type, used to implement additional run-time
|
||||
* type checking.
|
||||
* @const {!Object}
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeHtml.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ = {};
|
||||
|
||||
|
||||
/**
|
||||
* Package-internal utility method to create SafeHtml instances.
|
||||
*
|
||||
* @param {string} html The string to initialize the SafeHtml object with.
|
||||
* @param {?goog.i18n.bidi.Dir} dir The directionality of the SafeHtml to be
|
||||
* constructed, or null if unknown.
|
||||
* @return {!goog.html.SafeHtml} The initialized SafeHtml object.
|
||||
* @package
|
||||
*/
|
||||
goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse = function(
|
||||
html, dir) {
|
||||
return new goog.html.SafeHtml().initSecurityPrivateDoNotAccessOrElse_(
|
||||
html, dir);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Called from createSafeHtmlSecurityPrivateDoNotAccessOrElse(). This
|
||||
* method exists only so that the compiler can dead code eliminate static
|
||||
* fields (like EMPTY) when they're not accessed.
|
||||
* @param {string} html
|
||||
* @param {?goog.i18n.bidi.Dir} dir
|
||||
* @return {!goog.html.SafeHtml}
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeHtml.prototype.initSecurityPrivateDoNotAccessOrElse_ = function(
|
||||
html, dir) {
|
||||
this.privateDoNotAccessOrElseSafeHtmlWrappedValue_ = html;
|
||||
this.dir_ = dir;
|
||||
return this;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Like create() but does not restrict which tags can be constructed.
|
||||
*
|
||||
* @param {string} tagName Tag name. Set or validated by caller.
|
||||
* @param {?Object<string, ?goog.html.SafeHtml.AttributeValue>=} opt_attributes
|
||||
* @param {(!goog.html.SafeHtml.TextOrHtml_|
|
||||
* !Array<!goog.html.SafeHtml.TextOrHtml_>)=} opt_content
|
||||
* @return {!goog.html.SafeHtml}
|
||||
* @throws {Error} If invalid or unsafe attribute name or value is provided.
|
||||
* @throws {goog.asserts.AssertionError} If content for void tag is provided.
|
||||
* @package
|
||||
*/
|
||||
goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse = function(
|
||||
tagName, opt_attributes, opt_content) {
|
||||
var dir = null;
|
||||
var result = '<' + tagName;
|
||||
result += goog.html.SafeHtml.stringifyAttributes(tagName, opt_attributes);
|
||||
|
||||
var content = opt_content;
|
||||
if (!goog.isDefAndNotNull(content)) {
|
||||
content = [];
|
||||
} else if (!goog.isArray(content)) {
|
||||
content = [content];
|
||||
}
|
||||
|
||||
if (goog.dom.tags.isVoidTag(tagName.toLowerCase())) {
|
||||
goog.asserts.assert(
|
||||
!content.length, 'Void tag <' + tagName + '> does not allow content.');
|
||||
result += '>';
|
||||
} else {
|
||||
var html = goog.html.SafeHtml.concat(content);
|
||||
result += '>' + goog.html.SafeHtml.unwrap(html) + '</' + tagName + '>';
|
||||
dir = html.getDirection();
|
||||
}
|
||||
|
||||
var dirAttribute = opt_attributes && opt_attributes['dir'];
|
||||
if (dirAttribute) {
|
||||
if (/^(ltr|rtl|auto)$/i.test(dirAttribute)) {
|
||||
// If the tag has the "dir" attribute specified then its direction is
|
||||
// neutral because it can be safely used in any context.
|
||||
dir = goog.i18n.bidi.Dir.NEUTRAL;
|
||||
} else {
|
||||
dir = null;
|
||||
}
|
||||
}
|
||||
|
||||
return goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse(
|
||||
result, dir);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a string with attributes to insert after tagName.
|
||||
* @param {string} tagName
|
||||
* @param {?Object<string, ?goog.html.SafeHtml.AttributeValue>=} opt_attributes
|
||||
* @return {string} Returns an empty string if there are no attributes, returns
|
||||
* a string starting with a space otherwise.
|
||||
* @throws {Error} If attribute value is unsafe for the given tag and attribute.
|
||||
* @package
|
||||
*/
|
||||
goog.html.SafeHtml.stringifyAttributes = function(tagName, opt_attributes) {
|
||||
var result = '';
|
||||
if (opt_attributes) {
|
||||
for (var name in opt_attributes) {
|
||||
if (!goog.html.SafeHtml.VALID_NAMES_IN_TAG_.test(name)) {
|
||||
throw Error('Invalid attribute name "' + name + '".');
|
||||
}
|
||||
var value = opt_attributes[name];
|
||||
if (!goog.isDefAndNotNull(value)) {
|
||||
continue;
|
||||
}
|
||||
result +=
|
||||
' ' + goog.html.SafeHtml.getAttrNameAndValue_(tagName, name, value);
|
||||
}
|
||||
}
|
||||
return result;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @param {!Object<string, string>} fixedAttributes
|
||||
* @param {!Object<string, string>} defaultAttributes
|
||||
* @param {?Object<string, ?goog.html.SafeHtml.AttributeValue>=} opt_attributes
|
||||
* Optional attributes passed to create*().
|
||||
* @return {!Object<string, ?goog.html.SafeHtml.AttributeValue>}
|
||||
* @throws {Error} If opt_attributes contains an attribute with the same name
|
||||
* as an attribute in fixedAttributes.
|
||||
* @package
|
||||
*/
|
||||
goog.html.SafeHtml.combineAttributes = function(
|
||||
fixedAttributes, defaultAttributes, opt_attributes) {
|
||||
var combinedAttributes = {};
|
||||
var name;
|
||||
|
||||
for (name in fixedAttributes) {
|
||||
goog.asserts.assert(name.toLowerCase() == name, 'Must be lower case');
|
||||
combinedAttributes[name] = fixedAttributes[name];
|
||||
}
|
||||
for (name in defaultAttributes) {
|
||||
goog.asserts.assert(name.toLowerCase() == name, 'Must be lower case');
|
||||
combinedAttributes[name] = defaultAttributes[name];
|
||||
}
|
||||
|
||||
for (name in opt_attributes) {
|
||||
var nameLower = name.toLowerCase();
|
||||
if (nameLower in fixedAttributes) {
|
||||
throw Error(
|
||||
'Cannot override "' + nameLower + '" attribute, got "' + name +
|
||||
'" with value "' + opt_attributes[name] + '"');
|
||||
}
|
||||
if (nameLower in defaultAttributes) {
|
||||
delete combinedAttributes[nameLower];
|
||||
}
|
||||
combinedAttributes[name] = opt_attributes[name];
|
||||
}
|
||||
|
||||
return combinedAttributes;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* A SafeHtml instance corresponding to the HTML doctype: "<!DOCTYPE html>".
|
||||
* @const {!goog.html.SafeHtml}
|
||||
*/
|
||||
goog.html.SafeHtml.DOCTYPE_HTML =
|
||||
goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse(
|
||||
'<!DOCTYPE html>', goog.i18n.bidi.Dir.NEUTRAL);
|
||||
|
||||
|
||||
/**
|
||||
* A SafeHtml instance corresponding to the empty string.
|
||||
* @const {!goog.html.SafeHtml}
|
||||
*/
|
||||
goog.html.SafeHtml.EMPTY =
|
||||
goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse(
|
||||
'', goog.i18n.bidi.Dir.NEUTRAL);
|
||||
|
||||
|
||||
/**
|
||||
* A SafeHtml instance corresponding to the <br> tag.
|
||||
* @const {!goog.html.SafeHtml}
|
||||
*/
|
||||
goog.html.SafeHtml.BR =
|
||||
goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse(
|
||||
'<br>', goog.i18n.bidi.Dir.NEUTRAL);
|
||||
234
resources/public/js/compiled/out/goog/html/safescript.js
Normal file
234
resources/public/js/compiled/out/goog/html/safescript.js
Normal file
|
|
@ -0,0 +1,234 @@
|
|||
// Copyright 2014 The Closure Library Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS-IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
/**
|
||||
* @fileoverview The SafeScript type and its builders.
|
||||
*
|
||||
* TODO(xtof): Link to document stating type contract.
|
||||
*/
|
||||
|
||||
goog.provide('goog.html.SafeScript');
|
||||
|
||||
goog.require('goog.asserts');
|
||||
goog.require('goog.string.Const');
|
||||
goog.require('goog.string.TypedString');
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* A string-like object which represents JavaScript code and that carries the
|
||||
* security type contract that its value, as a string, will not cause execution
|
||||
* of unconstrained attacker controlled code (XSS) when evaluated as JavaScript
|
||||
* in a browser.
|
||||
*
|
||||
* Instances of this type must be created via the factory method
|
||||
* {@code goog.html.SafeScript.fromConstant} and not by invoking its
|
||||
* constructor. The constructor intentionally takes no parameters and the type
|
||||
* is immutable; hence only a default instance corresponding to the empty string
|
||||
* can be obtained via constructor invocation.
|
||||
*
|
||||
* A SafeScript's string representation can safely be interpolated as the
|
||||
* content of a script element within HTML. The SafeScript string should not be
|
||||
* escaped before interpolation.
|
||||
*
|
||||
* Note that the SafeScript might contain text that is attacker-controlled but
|
||||
* that text should have been interpolated with appropriate escaping,
|
||||
* sanitization and/or validation into the right location in the script, such
|
||||
* that it is highly constrained in its effect (for example, it had to match a
|
||||
* set of whitelisted words).
|
||||
*
|
||||
* A SafeScript can be constructed via security-reviewed unchecked
|
||||
* conversions. In this case producers of SafeScript must ensure themselves that
|
||||
* the SafeScript does not contain unsafe script. Note in particular that
|
||||
* {@code <} is dangerous, even when inside JavaScript strings, and so should
|
||||
* always be forbidden or JavaScript escaped in user controlled input. For
|
||||
* example, if {@code </script><script>evil</script>"} were
|
||||
* interpolated inside a JavaScript string, it would break out of the context
|
||||
* of the original script element and {@code evil} would execute. Also note
|
||||
* that within an HTML script (raw text) element, HTML character references,
|
||||
* such as "<" are not allowed. See
|
||||
* http://www.w3.org/TR/html5/scripting-1.html#restrictions-for-contents-of-script-elements.
|
||||
*
|
||||
* @see goog.html.SafeScript#fromConstant
|
||||
* @constructor
|
||||
* @final
|
||||
* @struct
|
||||
* @implements {goog.string.TypedString}
|
||||
*/
|
||||
goog.html.SafeScript = function() {
|
||||
/**
|
||||
* The contained value of this SafeScript. The field has a purposely
|
||||
* ugly name to make (non-compiled) code that attempts to directly access this
|
||||
* field stand out.
|
||||
* @private {string}
|
||||
*/
|
||||
this.privateDoNotAccessOrElseSafeScriptWrappedValue_ = '';
|
||||
|
||||
/**
|
||||
* A type marker used to implement additional run-time type checking.
|
||||
* @see goog.html.SafeScript#unwrap
|
||||
* @const
|
||||
* @private
|
||||
*/
|
||||
this.SAFE_SCRIPT_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ =
|
||||
goog.html.SafeScript.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @override
|
||||
* @const
|
||||
*/
|
||||
goog.html.SafeScript.prototype.implementsGoogStringTypedString = true;
|
||||
|
||||
|
||||
/**
|
||||
* Type marker for the SafeScript type, used to implement additional
|
||||
* run-time type checking.
|
||||
* @const {!Object}
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeScript.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ = {};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeScript object from a compile-time constant string.
|
||||
*
|
||||
* @param {!goog.string.Const} script A compile-time-constant string from which
|
||||
* to create a SafeScript.
|
||||
* @return {!goog.html.SafeScript} A SafeScript object initialized to
|
||||
* {@code script}.
|
||||
*/
|
||||
goog.html.SafeScript.fromConstant = function(script) {
|
||||
var scriptString = goog.string.Const.unwrap(script);
|
||||
if (scriptString.length === 0) {
|
||||
return goog.html.SafeScript.EMPTY;
|
||||
}
|
||||
return goog.html.SafeScript.createSafeScriptSecurityPrivateDoNotAccessOrElse(
|
||||
scriptString);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Returns this SafeScript's value as a string.
|
||||
*
|
||||
* IMPORTANT: In code where it is security relevant that an object's type is
|
||||
* indeed {@code SafeScript}, use {@code goog.html.SafeScript.unwrap} instead of
|
||||
* this method. If in doubt, assume that it's security relevant. In particular,
|
||||
* note that goog.html functions which return a goog.html type do not guarantee
|
||||
* the returned instance is of the right type. For example:
|
||||
*
|
||||
* <pre>
|
||||
* var fakeSafeHtml = new String('fake');
|
||||
* fakeSafeHtml.__proto__ = goog.html.SafeHtml.prototype;
|
||||
* var newSafeHtml = goog.html.SafeHtml.htmlEscape(fakeSafeHtml);
|
||||
* // newSafeHtml is just an alias for fakeSafeHtml, it's passed through by
|
||||
* // goog.html.SafeHtml.htmlEscape() as fakeSafeHtml
|
||||
* // instanceof goog.html.SafeHtml.
|
||||
* </pre>
|
||||
*
|
||||
* @see goog.html.SafeScript#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeScript.prototype.getTypedStringValue = function() {
|
||||
return this.privateDoNotAccessOrElseSafeScriptWrappedValue_;
|
||||
};
|
||||
|
||||
|
||||
if (goog.DEBUG) {
|
||||
/**
|
||||
* Returns a debug string-representation of this value.
|
||||
*
|
||||
* To obtain the actual string value wrapped in a SafeScript, use
|
||||
* {@code goog.html.SafeScript.unwrap}.
|
||||
*
|
||||
* @see goog.html.SafeScript#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeScript.prototype.toString = function() {
|
||||
return 'SafeScript{' +
|
||||
this.privateDoNotAccessOrElseSafeScriptWrappedValue_ + '}';
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Performs a runtime check that the provided object is indeed a
|
||||
* SafeScript object, and returns its value.
|
||||
*
|
||||
* @param {!goog.html.SafeScript} safeScript The object to extract from.
|
||||
* @return {string} The safeScript object's contained string, unless
|
||||
* the run-time type check fails. In that case, {@code unwrap} returns an
|
||||
* innocuous string, or, if assertions are enabled, throws
|
||||
* {@code goog.asserts.AssertionError}.
|
||||
*/
|
||||
goog.html.SafeScript.unwrap = function(safeScript) {
|
||||
// Perform additional Run-time type-checking to ensure that
|
||||
// safeScript is indeed an instance of the expected type. This
|
||||
// provides some additional protection against security bugs due to
|
||||
// application code that disables type checks.
|
||||
// Specifically, the following checks are performed:
|
||||
// 1. The object is an instance of the expected type.
|
||||
// 2. The object is not an instance of a subclass.
|
||||
// 3. The object carries a type marker for the expected type. "Faking" an
|
||||
// object requires a reference to the type marker, which has names intended
|
||||
// to stand out in code reviews.
|
||||
if (safeScript instanceof goog.html.SafeScript &&
|
||||
safeScript.constructor === goog.html.SafeScript &&
|
||||
safeScript.SAFE_SCRIPT_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ ===
|
||||
goog.html.SafeScript.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_) {
|
||||
return safeScript.privateDoNotAccessOrElseSafeScriptWrappedValue_;
|
||||
} else {
|
||||
goog.asserts.fail('expected object of type SafeScript, got \'' +
|
||||
safeScript + '\' of type ' + goog.typeOf(safeScript));
|
||||
return 'type_error:SafeScript';
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Package-internal utility method to create SafeScript instances.
|
||||
*
|
||||
* @param {string} script The string to initialize the SafeScript object with.
|
||||
* @return {!goog.html.SafeScript} The initialized SafeScript object.
|
||||
* @package
|
||||
*/
|
||||
goog.html.SafeScript.createSafeScriptSecurityPrivateDoNotAccessOrElse =
|
||||
function(script) {
|
||||
return new goog.html.SafeScript().initSecurityPrivateDoNotAccessOrElse_(
|
||||
script);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Called from createSafeScriptSecurityPrivateDoNotAccessOrElse(). This
|
||||
* method exists only so that the compiler can dead code eliminate static
|
||||
* fields (like EMPTY) when they're not accessed.
|
||||
* @param {string} script
|
||||
* @return {!goog.html.SafeScript}
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeScript.prototype.initSecurityPrivateDoNotAccessOrElse_ = function(
|
||||
script) {
|
||||
this.privateDoNotAccessOrElseSafeScriptWrappedValue_ = script;
|
||||
return this;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* A SafeScript instance corresponding to the empty string.
|
||||
* @const {!goog.html.SafeScript}
|
||||
*/
|
||||
goog.html.SafeScript.EMPTY =
|
||||
goog.html.SafeScript.createSafeScriptSecurityPrivateDoNotAccessOrElse('');
|
||||
449
resources/public/js/compiled/out/goog/html/safestyle.js
Normal file
449
resources/public/js/compiled/out/goog/html/safestyle.js
Normal file
|
|
@ -0,0 +1,449 @@
|
|||
// Copyright 2014 The Closure Library Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS-IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
/**
|
||||
* @fileoverview The SafeStyle type and its builders.
|
||||
*
|
||||
* TODO(xtof): Link to document stating type contract.
|
||||
*/
|
||||
|
||||
goog.provide('goog.html.SafeStyle');
|
||||
|
||||
goog.require('goog.array');
|
||||
goog.require('goog.asserts');
|
||||
goog.require('goog.string');
|
||||
goog.require('goog.string.Const');
|
||||
goog.require('goog.string.TypedString');
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* A string-like object which represents a sequence of CSS declarations
|
||||
* ({@code propertyName1: propertyvalue1; propertyName2: propertyValue2; ...})
|
||||
* and that carries the security type contract that its value, as a string,
|
||||
* will not cause untrusted script execution (XSS) when evaluated as CSS in a
|
||||
* browser.
|
||||
*
|
||||
* Instances of this type must be created via the factory methods
|
||||
* ({@code goog.html.SafeStyle.create} or
|
||||
* {@code goog.html.SafeStyle.fromConstant}) and not by invoking its
|
||||
* constructor. The constructor intentionally takes no parameters and the type
|
||||
* is immutable; hence only a default instance corresponding to the empty string
|
||||
* can be obtained via constructor invocation.
|
||||
*
|
||||
* A SafeStyle's string representation ({@link #getTypedStringValue()}) can
|
||||
* safely:
|
||||
* <ul>
|
||||
* <li>Be interpolated as the entire content of a *quoted* HTML style
|
||||
* attribute, or before already existing properties. The SafeStyle string
|
||||
* *must be HTML-attribute-escaped* (where " and ' are escaped) before
|
||||
* interpolation.
|
||||
* <li>Be interpolated as the entire content of a {}-wrapped block within a
|
||||
* stylesheet, or before already existing properties. The SafeStyle string
|
||||
* should not be escaped before interpolation. SafeStyle's contract also
|
||||
* guarantees that the string will not be able to introduce new properties
|
||||
* or elide existing ones.
|
||||
* <li>Be assigned to the style property of a DOM node. The SafeStyle string
|
||||
* should not be escaped before being assigned to the property.
|
||||
* </ul>
|
||||
*
|
||||
* A SafeStyle may never contain literal angle brackets. Otherwise, it could
|
||||
* be unsafe to place a SafeStyle into a <style> tag (where it can't
|
||||
* be HTML escaped). For example, if the SafeStyle containing
|
||||
* "{@code font: 'foo <style/><script>evil</script>'}" were
|
||||
* interpolated within a <style> tag, this would then break out of the
|
||||
* style context into HTML.
|
||||
*
|
||||
* A SafeStyle may contain literal single or double quotes, and as such the
|
||||
* entire style string must be escaped when used in a style attribute (if
|
||||
* this were not the case, the string could contain a matching quote that
|
||||
* would escape from the style attribute).
|
||||
*
|
||||
* Values of this type must be composable, i.e. for any two values
|
||||
* {@code style1} and {@code style2} of this type,
|
||||
* {@code goog.html.SafeStyle.unwrap(style1) +
|
||||
* goog.html.SafeStyle.unwrap(style2)} must itself be a value that satisfies
|
||||
* the SafeStyle type constraint. This requirement implies that for any value
|
||||
* {@code style} of this type, {@code goog.html.SafeStyle.unwrap(style)} must
|
||||
* not end in a "property value" or "property name" context. For example,
|
||||
* a value of {@code background:url("} or {@code font-} would not satisfy the
|
||||
* SafeStyle contract. This is because concatenating such strings with a
|
||||
* second value that itself does not contain unsafe CSS can result in an
|
||||
* overall string that does. For example, if {@code javascript:evil())"} is
|
||||
* appended to {@code background:url("}, the resulting string may result in
|
||||
* the execution of a malicious script.
|
||||
*
|
||||
* TODO(user): Consider whether we should implement UTF-8 interchange
|
||||
* validity checks and blacklisting of newlines (including Unicode ones) and
|
||||
* other whitespace characters (\t, \f). Document here if so and also update
|
||||
* SafeStyle.fromConstant().
|
||||
*
|
||||
* The following example values comply with this type's contract:
|
||||
* <ul>
|
||||
* <li><pre>width: 1em;</pre>
|
||||
* <li><pre>height:1em;</pre>
|
||||
* <li><pre>width: 1em;height: 1em;</pre>
|
||||
* <li><pre>background:url('http://url');</pre>
|
||||
* </ul>
|
||||
* In addition, the empty string is safe for use in a CSS attribute.
|
||||
*
|
||||
* The following example values do NOT comply with this type's contract:
|
||||
* <ul>
|
||||
* <li><pre>background: red</pre> (missing a trailing semi-colon)
|
||||
* <li><pre>background:</pre> (missing a value and a trailing semi-colon)
|
||||
* <li><pre>1em</pre> (missing an attribute name, which provides context for
|
||||
* the value)
|
||||
* </ul>
|
||||
*
|
||||
* @see goog.html.SafeStyle#create
|
||||
* @see goog.html.SafeStyle#fromConstant
|
||||
* @see http://www.w3.org/TR/css3-syntax/
|
||||
* @constructor
|
||||
* @final
|
||||
* @struct
|
||||
* @implements {goog.string.TypedString}
|
||||
*/
|
||||
goog.html.SafeStyle = function() {
|
||||
/**
|
||||
* The contained value of this SafeStyle. The field has a purposely
|
||||
* ugly name to make (non-compiled) code that attempts to directly access this
|
||||
* field stand out.
|
||||
* @private {string}
|
||||
*/
|
||||
this.privateDoNotAccessOrElseSafeStyleWrappedValue_ = '';
|
||||
|
||||
/**
|
||||
* A type marker used to implement additional run-time type checking.
|
||||
* @see goog.html.SafeStyle#unwrap
|
||||
* @const
|
||||
* @private
|
||||
*/
|
||||
this.SAFE_STYLE_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ =
|
||||
goog.html.SafeStyle.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @override
|
||||
* @const
|
||||
*/
|
||||
goog.html.SafeStyle.prototype.implementsGoogStringTypedString = true;
|
||||
|
||||
|
||||
/**
|
||||
* Type marker for the SafeStyle type, used to implement additional
|
||||
* run-time type checking.
|
||||
* @const {!Object}
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeStyle.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ = {};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeStyle object from a compile-time constant string.
|
||||
*
|
||||
* {@code style} should be in the format
|
||||
* {@code name: value; [name: value; ...]} and must not have any < or >
|
||||
* characters in it. This is so that SafeStyle's contract is preserved,
|
||||
* allowing the SafeStyle to correctly be interpreted as a sequence of CSS
|
||||
* declarations and without affecting the syntactic structure of any
|
||||
* surrounding CSS and HTML.
|
||||
*
|
||||
* This method performs basic sanity checks on the format of {@code style}
|
||||
* but does not constrain the format of {@code name} and {@code value}, except
|
||||
* for disallowing tag characters.
|
||||
*
|
||||
* @param {!goog.string.Const} style A compile-time-constant string from which
|
||||
* to create a SafeStyle.
|
||||
* @return {!goog.html.SafeStyle} A SafeStyle object initialized to
|
||||
* {@code style}.
|
||||
*/
|
||||
goog.html.SafeStyle.fromConstant = function(style) {
|
||||
var styleString = goog.string.Const.unwrap(style);
|
||||
if (styleString.length === 0) {
|
||||
return goog.html.SafeStyle.EMPTY;
|
||||
}
|
||||
goog.html.SafeStyle.checkStyle_(styleString);
|
||||
goog.asserts.assert(
|
||||
goog.string.endsWith(styleString, ';'),
|
||||
'Last character of style string is not \';\': ' + styleString);
|
||||
goog.asserts.assert(
|
||||
goog.string.contains(styleString, ':'),
|
||||
'Style string must contain at least one \':\', to ' +
|
||||
'specify a "name: value" pair: ' + styleString);
|
||||
return goog.html.SafeStyle.createSafeStyleSecurityPrivateDoNotAccessOrElse(
|
||||
styleString);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Checks if the style definition is valid.
|
||||
* @param {string} style
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeStyle.checkStyle_ = function(style) {
|
||||
goog.asserts.assert(
|
||||
!/[<>]/.test(style), 'Forbidden characters in style string: ' + style);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Returns this SafeStyle's value as a string.
|
||||
*
|
||||
* IMPORTANT: In code where it is security relevant that an object's type is
|
||||
* indeed {@code SafeStyle}, use {@code goog.html.SafeStyle.unwrap} instead of
|
||||
* this method. If in doubt, assume that it's security relevant. In particular,
|
||||
* note that goog.html functions which return a goog.html type do not guarantee
|
||||
* the returned instance is of the right type. For example:
|
||||
*
|
||||
* <pre>
|
||||
* var fakeSafeHtml = new String('fake');
|
||||
* fakeSafeHtml.__proto__ = goog.html.SafeHtml.prototype;
|
||||
* var newSafeHtml = goog.html.SafeHtml.htmlEscape(fakeSafeHtml);
|
||||
* // newSafeHtml is just an alias for fakeSafeHtml, it's passed through by
|
||||
* // goog.html.SafeHtml.htmlEscape() as fakeSafeHtml
|
||||
* // instanceof goog.html.SafeHtml.
|
||||
* </pre>
|
||||
*
|
||||
* @see goog.html.SafeStyle#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeStyle.prototype.getTypedStringValue = function() {
|
||||
return this.privateDoNotAccessOrElseSafeStyleWrappedValue_;
|
||||
};
|
||||
|
||||
|
||||
if (goog.DEBUG) {
|
||||
/**
|
||||
* Returns a debug string-representation of this value.
|
||||
*
|
||||
* To obtain the actual string value wrapped in a SafeStyle, use
|
||||
* {@code goog.html.SafeStyle.unwrap}.
|
||||
*
|
||||
* @see goog.html.SafeStyle#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeStyle.prototype.toString = function() {
|
||||
return 'SafeStyle{' + this.privateDoNotAccessOrElseSafeStyleWrappedValue_ +
|
||||
'}';
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Performs a runtime check that the provided object is indeed a
|
||||
* SafeStyle object, and returns its value.
|
||||
*
|
||||
* @param {!goog.html.SafeStyle} safeStyle The object to extract from.
|
||||
* @return {string} The safeStyle object's contained string, unless
|
||||
* the run-time type check fails. In that case, {@code unwrap} returns an
|
||||
* innocuous string, or, if assertions are enabled, throws
|
||||
* {@code goog.asserts.AssertionError}.
|
||||
*/
|
||||
goog.html.SafeStyle.unwrap = function(safeStyle) {
|
||||
// Perform additional Run-time type-checking to ensure that
|
||||
// safeStyle is indeed an instance of the expected type. This
|
||||
// provides some additional protection against security bugs due to
|
||||
// application code that disables type checks.
|
||||
// Specifically, the following checks are performed:
|
||||
// 1. The object is an instance of the expected type.
|
||||
// 2. The object is not an instance of a subclass.
|
||||
// 3. The object carries a type marker for the expected type. "Faking" an
|
||||
// object requires a reference to the type marker, which has names intended
|
||||
// to stand out in code reviews.
|
||||
if (safeStyle instanceof goog.html.SafeStyle &&
|
||||
safeStyle.constructor === goog.html.SafeStyle &&
|
||||
safeStyle.SAFE_STYLE_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ ===
|
||||
goog.html.SafeStyle.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_) {
|
||||
return safeStyle.privateDoNotAccessOrElseSafeStyleWrappedValue_;
|
||||
} else {
|
||||
goog.asserts.fail('expected object of type SafeStyle, got \'' +
|
||||
safeStyle + '\' of type ' + goog.typeOf(safeStyle));
|
||||
return 'type_error:SafeStyle';
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Package-internal utility method to create SafeStyle instances.
|
||||
*
|
||||
* @param {string} style The string to initialize the SafeStyle object with.
|
||||
* @return {!goog.html.SafeStyle} The initialized SafeStyle object.
|
||||
* @package
|
||||
*/
|
||||
goog.html.SafeStyle.createSafeStyleSecurityPrivateDoNotAccessOrElse = function(
|
||||
style) {
|
||||
return new goog.html.SafeStyle().initSecurityPrivateDoNotAccessOrElse_(style);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Called from createSafeStyleSecurityPrivateDoNotAccessOrElse(). This
|
||||
* method exists only so that the compiler can dead code eliminate static
|
||||
* fields (like EMPTY) when they're not accessed.
|
||||
* @param {string} style
|
||||
* @return {!goog.html.SafeStyle}
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeStyle.prototype.initSecurityPrivateDoNotAccessOrElse_ = function(
|
||||
style) {
|
||||
this.privateDoNotAccessOrElseSafeStyleWrappedValue_ = style;
|
||||
return this;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* A SafeStyle instance corresponding to the empty string.
|
||||
* @const {!goog.html.SafeStyle}
|
||||
*/
|
||||
goog.html.SafeStyle.EMPTY =
|
||||
goog.html.SafeStyle.createSafeStyleSecurityPrivateDoNotAccessOrElse('');
|
||||
|
||||
|
||||
/**
|
||||
* The innocuous string generated by goog.html.SafeUrl.create when passed
|
||||
* an unsafe value.
|
||||
* @const {string}
|
||||
*/
|
||||
goog.html.SafeStyle.INNOCUOUS_STRING = 'zClosurez';
|
||||
|
||||
|
||||
/**
|
||||
* Mapping of property names to their values.
|
||||
* @typedef {!Object<string, goog.string.Const|string>}
|
||||
*/
|
||||
goog.html.SafeStyle.PropertyMap;
|
||||
|
||||
|
||||
/**
|
||||
* Creates a new SafeStyle object from the properties specified in the map.
|
||||
* @param {goog.html.SafeStyle.PropertyMap} map Mapping of property names to
|
||||
* their values, for example {'margin': '1px'}. Names must consist of
|
||||
* [-_a-zA-Z0-9]. Values might be strings consisting of
|
||||
* [-,.'"%_!# a-zA-Z0-9], where " and ' must be properly balanced.
|
||||
* Other values must be wrapped in goog.string.Const. Null value causes
|
||||
* skipping the property.
|
||||
* @return {!goog.html.SafeStyle}
|
||||
* @throws {Error} If invalid name is provided.
|
||||
* @throws {goog.asserts.AssertionError} If invalid value is provided. With
|
||||
* disabled assertions, invalid value is replaced by
|
||||
* goog.html.SafeStyle.INNOCUOUS_STRING.
|
||||
*/
|
||||
goog.html.SafeStyle.create = function(map) {
|
||||
var style = '';
|
||||
for (var name in map) {
|
||||
if (!/^[-_a-zA-Z0-9]+$/.test(name)) {
|
||||
throw Error('Name allows only [-_a-zA-Z0-9], got: ' + name);
|
||||
}
|
||||
var value = map[name];
|
||||
if (value == null) {
|
||||
continue;
|
||||
}
|
||||
if (value instanceof goog.string.Const) {
|
||||
value = goog.string.Const.unwrap(value);
|
||||
// These characters can be used to change context and we don't want that
|
||||
// even with const values.
|
||||
goog.asserts.assert(!/[{;}]/.test(value), 'Value does not allow [{;}].');
|
||||
} else if (!goog.html.SafeStyle.VALUE_RE_.test(value)) {
|
||||
goog.asserts.fail(
|
||||
'String value allows only [-,."\'%_!# a-zA-Z0-9], rgb() and ' +
|
||||
'rgba(), got: ' + value);
|
||||
value = goog.html.SafeStyle.INNOCUOUS_STRING;
|
||||
} else if (!goog.html.SafeStyle.hasBalancedQuotes_(value)) {
|
||||
goog.asserts.fail('String value requires balanced quotes, got: ' + value);
|
||||
value = goog.html.SafeStyle.INNOCUOUS_STRING;
|
||||
}
|
||||
style += name + ':' + value + ';';
|
||||
}
|
||||
if (!style) {
|
||||
return goog.html.SafeStyle.EMPTY;
|
||||
}
|
||||
goog.html.SafeStyle.checkStyle_(style);
|
||||
return goog.html.SafeStyle.createSafeStyleSecurityPrivateDoNotAccessOrElse(
|
||||
style);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Checks that quotes (" and ') are properly balanced inside a string. Assumes
|
||||
* that neither escape (\) nor any other character that could result in
|
||||
* breaking out of a string parsing context are allowed;
|
||||
* see http://www.w3.org/TR/css3-syntax/#string-token-diagram.
|
||||
* @param {string} value Untrusted CSS property value.
|
||||
* @return {boolean} True if property value is safe with respect to quote
|
||||
* balancedness.
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeStyle.hasBalancedQuotes_ = function(value) {
|
||||
var outsideSingle = true;
|
||||
var outsideDouble = true;
|
||||
for (var i = 0; i < value.length; i++) {
|
||||
var c = value.charAt(i);
|
||||
if (c == "'" && outsideDouble) {
|
||||
outsideSingle = !outsideSingle;
|
||||
} else if (c == '"' && outsideSingle) {
|
||||
outsideDouble = !outsideDouble;
|
||||
}
|
||||
}
|
||||
return outsideSingle && outsideDouble;
|
||||
};
|
||||
|
||||
|
||||
// Keep in sync with the error string in create().
|
||||
/**
|
||||
* Regular expression for safe values.
|
||||
*
|
||||
* Quotes (" and ') are allowed, but a check must be done elsewhere to ensure
|
||||
* they're balanced.
|
||||
*
|
||||
* ',' allows multiple values to be assigned to the same property
|
||||
* (e.g. background-attachment or font-family) and hence could allow
|
||||
* multiple values to get injected, but that should pose no risk of XSS.
|
||||
*
|
||||
* The rgb() and rgba() expression checks only for XSS safety, not for CSS
|
||||
* validity.
|
||||
* @const {!RegExp}
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeStyle.VALUE_RE_ =
|
||||
/^([-,."'%_!# a-zA-Z0-9]+|(?:rgb|hsl)a?\([0-9.%, ]+\))$/;
|
||||
|
||||
|
||||
/**
|
||||
* Creates a new SafeStyle object by concatenating the values.
|
||||
* @param {...(!goog.html.SafeStyle|!Array<!goog.html.SafeStyle>)} var_args
|
||||
* SafeStyles to concatenate.
|
||||
* @return {!goog.html.SafeStyle}
|
||||
*/
|
||||
goog.html.SafeStyle.concat = function(var_args) {
|
||||
var style = '';
|
||||
|
||||
/**
|
||||
* @param {!goog.html.SafeStyle|!Array<!goog.html.SafeStyle>} argument
|
||||
*/
|
||||
var addArgument = function(argument) {
|
||||
if (goog.isArray(argument)) {
|
||||
goog.array.forEach(argument, addArgument);
|
||||
} else {
|
||||
style += goog.html.SafeStyle.unwrap(argument);
|
||||
}
|
||||
};
|
||||
|
||||
goog.array.forEach(arguments, addArgument);
|
||||
if (!style) {
|
||||
return goog.html.SafeStyle.EMPTY;
|
||||
}
|
||||
return goog.html.SafeStyle.createSafeStyleSecurityPrivateDoNotAccessOrElse(
|
||||
style);
|
||||
};
|
||||
278
resources/public/js/compiled/out/goog/html/safestylesheet.js
Normal file
278
resources/public/js/compiled/out/goog/html/safestylesheet.js
Normal file
|
|
@ -0,0 +1,278 @@
|
|||
// Copyright 2014 The Closure Library Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS-IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
/**
|
||||
* @fileoverview The SafeStyleSheet type and its builders.
|
||||
*
|
||||
* TODO(xtof): Link to document stating type contract.
|
||||
*/
|
||||
|
||||
goog.provide('goog.html.SafeStyleSheet');
|
||||
|
||||
goog.require('goog.array');
|
||||
goog.require('goog.asserts');
|
||||
goog.require('goog.string');
|
||||
goog.require('goog.string.Const');
|
||||
goog.require('goog.string.TypedString');
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* A string-like object which represents a CSS style sheet and that carries the
|
||||
* security type contract that its value, as a string, will not cause untrusted
|
||||
* script execution (XSS) when evaluated as CSS in a browser.
|
||||
*
|
||||
* Instances of this type must be created via the factory method
|
||||
* {@code goog.html.SafeStyleSheet.fromConstant} and not by invoking its
|
||||
* constructor. The constructor intentionally takes no parameters and the type
|
||||
* is immutable; hence only a default instance corresponding to the empty string
|
||||
* can be obtained via constructor invocation.
|
||||
*
|
||||
* A SafeStyleSheet's string representation can safely be interpolated as the
|
||||
* content of a style element within HTML. The SafeStyleSheet string should
|
||||
* not be escaped before interpolation.
|
||||
*
|
||||
* Values of this type must be composable, i.e. for any two values
|
||||
* {@code styleSheet1} and {@code styleSheet2} of this type,
|
||||
* {@code goog.html.SafeStyleSheet.unwrap(styleSheet1) +
|
||||
* goog.html.SafeStyleSheet.unwrap(styleSheet2)} must itself be a value that
|
||||
* satisfies the SafeStyleSheet type constraint. This requirement implies that
|
||||
* for any value {@code styleSheet} of this type,
|
||||
* {@code goog.html.SafeStyleSheet.unwrap(styleSheet1)} must end in
|
||||
* "beginning of rule" context.
|
||||
|
||||
* A SafeStyleSheet can be constructed via security-reviewed unchecked
|
||||
* conversions. In this case producers of SafeStyleSheet must ensure themselves
|
||||
* that the SafeStyleSheet does not contain unsafe script. Note in particular
|
||||
* that {@code <} is dangerous, even when inside CSS strings, and so should
|
||||
* always be forbidden or CSS-escaped in user controlled input. For example, if
|
||||
* {@code </style><script>evil</script>"} were interpolated
|
||||
* inside a CSS string, it would break out of the context of the original
|
||||
* style element and {@code evil} would execute. Also note that within an HTML
|
||||
* style (raw text) element, HTML character references, such as
|
||||
* {@code &lt;}, are not allowed. See
|
||||
*
|
||||
http://www.w3.org/TR/html5/scripting-1.html#restrictions-for-contents-of-script-elements
|
||||
* (similar considerations apply to the style element).
|
||||
*
|
||||
* @see goog.html.SafeStyleSheet#fromConstant
|
||||
* @constructor
|
||||
* @final
|
||||
* @struct
|
||||
* @implements {goog.string.TypedString}
|
||||
*/
|
||||
goog.html.SafeStyleSheet = function() {
|
||||
/**
|
||||
* The contained value of this SafeStyleSheet. The field has a purposely
|
||||
* ugly name to make (non-compiled) code that attempts to directly access this
|
||||
* field stand out.
|
||||
* @private {string}
|
||||
*/
|
||||
this.privateDoNotAccessOrElseSafeStyleSheetWrappedValue_ = '';
|
||||
|
||||
/**
|
||||
* A type marker used to implement additional run-time type checking.
|
||||
* @see goog.html.SafeStyleSheet#unwrap
|
||||
* @const
|
||||
* @private
|
||||
*/
|
||||
this.SAFE_STYLE_SHEET_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ =
|
||||
goog.html.SafeStyleSheet.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @override
|
||||
* @const
|
||||
*/
|
||||
goog.html.SafeStyleSheet.prototype.implementsGoogStringTypedString = true;
|
||||
|
||||
|
||||
/**
|
||||
* Type marker for the SafeStyleSheet type, used to implement additional
|
||||
* run-time type checking.
|
||||
* @const {!Object}
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeStyleSheet.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ = {};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a new SafeStyleSheet object by concatenating values.
|
||||
* @param {...(!goog.html.SafeStyleSheet|!Array<!goog.html.SafeStyleSheet>)}
|
||||
* var_args Values to concatenate.
|
||||
* @return {!goog.html.SafeStyleSheet}
|
||||
*/
|
||||
goog.html.SafeStyleSheet.concat = function(var_args) {
|
||||
var result = '';
|
||||
|
||||
/**
|
||||
* @param {!goog.html.SafeStyleSheet|!Array<!goog.html.SafeStyleSheet>}
|
||||
* argument
|
||||
*/
|
||||
var addArgument = function(argument) {
|
||||
if (goog.isArray(argument)) {
|
||||
goog.array.forEach(argument, addArgument);
|
||||
} else {
|
||||
result += goog.html.SafeStyleSheet.unwrap(argument);
|
||||
}
|
||||
};
|
||||
|
||||
goog.array.forEach(arguments, addArgument);
|
||||
return goog.html.SafeStyleSheet
|
||||
.createSafeStyleSheetSecurityPrivateDoNotAccessOrElse(result);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeStyleSheet object from a compile-time constant string.
|
||||
*
|
||||
* {@code styleSheet} must not have any < characters in it, so that
|
||||
* the syntactic structure of the surrounding HTML is not affected.
|
||||
*
|
||||
* @param {!goog.string.Const} styleSheet A compile-time-constant string from
|
||||
* which to create a SafeStyleSheet.
|
||||
* @return {!goog.html.SafeStyleSheet} A SafeStyleSheet object initialized to
|
||||
* {@code styleSheet}.
|
||||
*/
|
||||
goog.html.SafeStyleSheet.fromConstant = function(styleSheet) {
|
||||
var styleSheetString = goog.string.Const.unwrap(styleSheet);
|
||||
if (styleSheetString.length === 0) {
|
||||
return goog.html.SafeStyleSheet.EMPTY;
|
||||
}
|
||||
// > is a valid character in CSS selectors and there's no strict need to
|
||||
// block it if we already block <.
|
||||
goog.asserts.assert(
|
||||
!goog.string.contains(styleSheetString, '<'),
|
||||
"Forbidden '<' character in style sheet string: " + styleSheetString);
|
||||
return goog.html.SafeStyleSheet
|
||||
.createSafeStyleSheetSecurityPrivateDoNotAccessOrElse(styleSheetString);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Returns this SafeStyleSheet's value as a string.
|
||||
*
|
||||
* IMPORTANT: In code where it is security relevant that an object's type is
|
||||
* indeed {@code SafeStyleSheet}, use {@code goog.html.SafeStyleSheet.unwrap}
|
||||
* instead of this method. If in doubt, assume that it's security relevant. In
|
||||
* particular, note that goog.html functions which return a goog.html type do
|
||||
* not guarantee the returned instance is of the right type. For example:
|
||||
*
|
||||
* <pre>
|
||||
* var fakeSafeHtml = new String('fake');
|
||||
* fakeSafeHtml.__proto__ = goog.html.SafeHtml.prototype;
|
||||
* var newSafeHtml = goog.html.SafeHtml.htmlEscape(fakeSafeHtml);
|
||||
* // newSafeHtml is just an alias for fakeSafeHtml, it's passed through by
|
||||
* // goog.html.SafeHtml.htmlEscape() as fakeSafeHtml
|
||||
* // instanceof goog.html.SafeHtml.
|
||||
* </pre>
|
||||
*
|
||||
* @see goog.html.SafeStyleSheet#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeStyleSheet.prototype.getTypedStringValue = function() {
|
||||
return this.privateDoNotAccessOrElseSafeStyleSheetWrappedValue_;
|
||||
};
|
||||
|
||||
|
||||
if (goog.DEBUG) {
|
||||
/**
|
||||
* Returns a debug string-representation of this value.
|
||||
*
|
||||
* To obtain the actual string value wrapped in a SafeStyleSheet, use
|
||||
* {@code goog.html.SafeStyleSheet.unwrap}.
|
||||
*
|
||||
* @see goog.html.SafeStyleSheet#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeStyleSheet.prototype.toString = function() {
|
||||
return 'SafeStyleSheet{' +
|
||||
this.privateDoNotAccessOrElseSafeStyleSheetWrappedValue_ + '}';
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Performs a runtime check that the provided object is indeed a
|
||||
* SafeStyleSheet object, and returns its value.
|
||||
*
|
||||
* @param {!goog.html.SafeStyleSheet} safeStyleSheet The object to extract from.
|
||||
* @return {string} The safeStyleSheet object's contained string, unless
|
||||
* the run-time type check fails. In that case, {@code unwrap} returns an
|
||||
* innocuous string, or, if assertions are enabled, throws
|
||||
* {@code goog.asserts.AssertionError}.
|
||||
*/
|
||||
goog.html.SafeStyleSheet.unwrap = function(safeStyleSheet) {
|
||||
// Perform additional Run-time type-checking to ensure that
|
||||
// safeStyleSheet is indeed an instance of the expected type. This
|
||||
// provides some additional protection against security bugs due to
|
||||
// application code that disables type checks.
|
||||
// Specifically, the following checks are performed:
|
||||
// 1. The object is an instance of the expected type.
|
||||
// 2. The object is not an instance of a subclass.
|
||||
// 3. The object carries a type marker for the expected type. "Faking" an
|
||||
// object requires a reference to the type marker, which has names intended
|
||||
// to stand out in code reviews.
|
||||
if (safeStyleSheet instanceof goog.html.SafeStyleSheet &&
|
||||
safeStyleSheet.constructor === goog.html.SafeStyleSheet &&
|
||||
safeStyleSheet
|
||||
.SAFE_STYLE_SHEET_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ ===
|
||||
goog.html.SafeStyleSheet.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_) {
|
||||
return safeStyleSheet.privateDoNotAccessOrElseSafeStyleSheetWrappedValue_;
|
||||
} else {
|
||||
goog.asserts.fail('expected object of type SafeStyleSheet, got \'' +
|
||||
safeStyleSheet + '\' of type ' + goog.typeOf(safeStyleSheet));
|
||||
return 'type_error:SafeStyleSheet';
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Package-internal utility method to create SafeStyleSheet instances.
|
||||
*
|
||||
* @param {string} styleSheet The string to initialize the SafeStyleSheet
|
||||
* object with.
|
||||
* @return {!goog.html.SafeStyleSheet} The initialized SafeStyleSheet object.
|
||||
* @package
|
||||
*/
|
||||
goog.html.SafeStyleSheet.createSafeStyleSheetSecurityPrivateDoNotAccessOrElse =
|
||||
function(styleSheet) {
|
||||
return new goog.html.SafeStyleSheet().initSecurityPrivateDoNotAccessOrElse_(
|
||||
styleSheet);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Called from createSafeStyleSheetSecurityPrivateDoNotAccessOrElse(). This
|
||||
* method exists only so that the compiler can dead code eliminate static
|
||||
* fields (like EMPTY) when they're not accessed.
|
||||
* @param {string} styleSheet
|
||||
* @return {!goog.html.SafeStyleSheet}
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeStyleSheet.prototype.initSecurityPrivateDoNotAccessOrElse_ =
|
||||
function(styleSheet) {
|
||||
this.privateDoNotAccessOrElseSafeStyleSheetWrappedValue_ = styleSheet;
|
||||
return this;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* A SafeStyleSheet instance corresponding to the empty string.
|
||||
* @const {!goog.html.SafeStyleSheet}
|
||||
*/
|
||||
goog.html.SafeStyleSheet.EMPTY =
|
||||
goog.html.SafeStyleSheet
|
||||
.createSafeStyleSheetSecurityPrivateDoNotAccessOrElse('');
|
||||
412
resources/public/js/compiled/out/goog/html/safeurl.js
Normal file
412
resources/public/js/compiled/out/goog/html/safeurl.js
Normal file
|
|
@ -0,0 +1,412 @@
|
|||
// Copyright 2013 The Closure Library Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS-IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
/**
|
||||
* @fileoverview The SafeUrl type and its builders.
|
||||
*
|
||||
* TODO(xtof): Link to document stating type contract.
|
||||
*/
|
||||
|
||||
goog.provide('goog.html.SafeUrl');
|
||||
|
||||
goog.require('goog.asserts');
|
||||
goog.require('goog.fs.url');
|
||||
goog.require('goog.i18n.bidi.Dir');
|
||||
goog.require('goog.i18n.bidi.DirectionalString');
|
||||
goog.require('goog.string');
|
||||
goog.require('goog.string.Const');
|
||||
goog.require('goog.string.TypedString');
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* A string that is safe to use in URL context in DOM APIs and HTML documents.
|
||||
*
|
||||
* A SafeUrl is a string-like object that carries the security type contract
|
||||
* that its value as a string will not cause untrusted script execution
|
||||
* when evaluated as a hyperlink URL in a browser.
|
||||
*
|
||||
* Values of this type are guaranteed to be safe to use in URL/hyperlink
|
||||
* contexts, such as, assignment to URL-valued DOM properties, or
|
||||
* interpolation into a HTML template in URL context (e.g., inside a href
|
||||
* attribute), in the sense that the use will not result in a
|
||||
* Cross-Site-Scripting vulnerability.
|
||||
*
|
||||
* Note that, as documented in {@code goog.html.SafeUrl.unwrap}, this type's
|
||||
* contract does not guarantee that instances are safe to interpolate into HTML
|
||||
* without appropriate escaping.
|
||||
*
|
||||
* Note also that this type's contract does not imply any guarantees regarding
|
||||
* the resource the URL refers to. In particular, SafeUrls are <b>not</b>
|
||||
* safe to use in a context where the referred-to resource is interpreted as
|
||||
* trusted code, e.g., as the src of a script tag.
|
||||
*
|
||||
* Instances of this type must be created via the factory methods
|
||||
* ({@code goog.html.SafeUrl.fromConstant}, {@code goog.html.SafeUrl.sanitize}),
|
||||
* etc and not by invoking its constructor. The constructor intentionally
|
||||
* takes no parameters and the type is immutable; hence only a default instance
|
||||
* corresponding to the empty string can be obtained via constructor invocation.
|
||||
*
|
||||
* @see goog.html.SafeUrl#fromConstant
|
||||
* @see goog.html.SafeUrl#from
|
||||
* @see goog.html.SafeUrl#sanitize
|
||||
* @constructor
|
||||
* @final
|
||||
* @struct
|
||||
* @implements {goog.i18n.bidi.DirectionalString}
|
||||
* @implements {goog.string.TypedString}
|
||||
*/
|
||||
goog.html.SafeUrl = function() {
|
||||
/**
|
||||
* The contained value of this SafeUrl. The field has a purposely ugly
|
||||
* name to make (non-compiled) code that attempts to directly access this
|
||||
* field stand out.
|
||||
* @private {string}
|
||||
*/
|
||||
this.privateDoNotAccessOrElseSafeHtmlWrappedValue_ = '';
|
||||
|
||||
/**
|
||||
* A type marker used to implement additional run-time type checking.
|
||||
* @see goog.html.SafeUrl#unwrap
|
||||
* @const
|
||||
* @private
|
||||
*/
|
||||
this.SAFE_URL_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ =
|
||||
goog.html.SafeUrl.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* The innocuous string generated by goog.html.SafeUrl.sanitize when passed
|
||||
* an unsafe URL.
|
||||
*
|
||||
* about:invalid is registered in
|
||||
* http://www.w3.org/TR/css3-values/#about-invalid.
|
||||
* http://tools.ietf.org/html/rfc6694#section-2.2.1 permits about URLs to
|
||||
* contain a fragment, which is not to be considered when determining if an
|
||||
* about URL is well-known.
|
||||
*
|
||||
* Using about:invalid seems preferable to using a fixed data URL, since
|
||||
* browsers might choose to not report CSP violations on it, as legitimate
|
||||
* CSS function calls to attr() can result in this URL being produced. It is
|
||||
* also a standard URL which matches exactly the semantics we need:
|
||||
* "The about:invalid URI references a non-existent document with a generic
|
||||
* error condition. It can be used when a URI is necessary, but the default
|
||||
* value shouldn't be resolveable as any type of document".
|
||||
*
|
||||
* @const {string}
|
||||
*/
|
||||
goog.html.SafeUrl.INNOCUOUS_STRING = 'about:invalid#zClosurez';
|
||||
|
||||
|
||||
/**
|
||||
* @override
|
||||
* @const
|
||||
*/
|
||||
goog.html.SafeUrl.prototype.implementsGoogStringTypedString = true;
|
||||
|
||||
|
||||
/**
|
||||
* Returns this SafeUrl's value a string.
|
||||
*
|
||||
* IMPORTANT: In code where it is security relevant that an object's type is
|
||||
* indeed {@code SafeUrl}, use {@code goog.html.SafeUrl.unwrap} instead of this
|
||||
* method. If in doubt, assume that it's security relevant. In particular, note
|
||||
* that goog.html functions which return a goog.html type do not guarantee that
|
||||
* the returned instance is of the right type. For example:
|
||||
*
|
||||
* <pre>
|
||||
* var fakeSafeHtml = new String('fake');
|
||||
* fakeSafeHtml.__proto__ = goog.html.SafeHtml.prototype;
|
||||
* var newSafeHtml = goog.html.SafeHtml.htmlEscape(fakeSafeHtml);
|
||||
* // newSafeHtml is just an alias for fakeSafeHtml, it's passed through by
|
||||
* // goog.html.SafeHtml.htmlEscape() as fakeSafeHtml instanceof
|
||||
* // goog.html.SafeHtml.
|
||||
* </pre>
|
||||
*
|
||||
* IMPORTANT: The guarantees of the SafeUrl type contract only extend to the
|
||||
* behavior of browsers when interpreting URLs. Values of SafeUrl objects MUST
|
||||
* be appropriately escaped before embedding in a HTML document. Note that the
|
||||
* required escaping is context-sensitive (e.g. a different escaping is
|
||||
* required for embedding a URL in a style property within a style
|
||||
* attribute, as opposed to embedding in a href attribute).
|
||||
*
|
||||
* @see goog.html.SafeUrl#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeUrl.prototype.getTypedStringValue = function() {
|
||||
return this.privateDoNotAccessOrElseSafeHtmlWrappedValue_;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @override
|
||||
* @const
|
||||
*/
|
||||
goog.html.SafeUrl.prototype.implementsGoogI18nBidiDirectionalString = true;
|
||||
|
||||
|
||||
/**
|
||||
* Returns this URLs directionality, which is always {@code LTR}.
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeUrl.prototype.getDirection = function() {
|
||||
return goog.i18n.bidi.Dir.LTR;
|
||||
};
|
||||
|
||||
|
||||
if (goog.DEBUG) {
|
||||
/**
|
||||
* Returns a debug string-representation of this value.
|
||||
*
|
||||
* To obtain the actual string value wrapped in a SafeUrl, use
|
||||
* {@code goog.html.SafeUrl.unwrap}.
|
||||
*
|
||||
* @see goog.html.SafeUrl#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.SafeUrl.prototype.toString = function() {
|
||||
return 'SafeUrl{' + this.privateDoNotAccessOrElseSafeHtmlWrappedValue_ +
|
||||
'}';
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Performs a runtime check that the provided object is indeed a SafeUrl
|
||||
* object, and returns its value.
|
||||
*
|
||||
* IMPORTANT: The guarantees of the SafeUrl type contract only extend to the
|
||||
* behavior of browsers when interpreting URLs. Values of SafeUrl objects MUST
|
||||
* be appropriately escaped before embedding in a HTML document. Note that the
|
||||
* required escaping is context-sensitive (e.g. a different escaping is
|
||||
* required for embedding a URL in a style property within a style
|
||||
* attribute, as opposed to embedding in a href attribute).
|
||||
*
|
||||
* @param {!goog.html.SafeUrl} safeUrl The object to extract from.
|
||||
* @return {string} The SafeUrl object's contained string, unless the run-time
|
||||
* type check fails. In that case, {@code unwrap} returns an innocuous
|
||||
* string, or, if assertions are enabled, throws
|
||||
* {@code goog.asserts.AssertionError}.
|
||||
*/
|
||||
goog.html.SafeUrl.unwrap = function(safeUrl) {
|
||||
// Perform additional Run-time type-checking to ensure that safeUrl is indeed
|
||||
// an instance of the expected type. This provides some additional protection
|
||||
// against security bugs due to application code that disables type checks.
|
||||
// Specifically, the following checks are performed:
|
||||
// 1. The object is an instance of the expected type.
|
||||
// 2. The object is not an instance of a subclass.
|
||||
// 3. The object carries a type marker for the expected type. "Faking" an
|
||||
// object requires a reference to the type marker, which has names intended
|
||||
// to stand out in code reviews.
|
||||
if (safeUrl instanceof goog.html.SafeUrl &&
|
||||
safeUrl.constructor === goog.html.SafeUrl &&
|
||||
safeUrl.SAFE_URL_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ ===
|
||||
goog.html.SafeUrl.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_) {
|
||||
return safeUrl.privateDoNotAccessOrElseSafeHtmlWrappedValue_;
|
||||
} else {
|
||||
goog.asserts.fail('expected object of type SafeUrl, got \'' +
|
||||
safeUrl + '\' of type ' + goog.typeOf(safeUrl));
|
||||
return 'type_error:SafeUrl';
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeUrl object from a compile-time constant string.
|
||||
*
|
||||
* Compile-time constant strings are inherently program-controlled and hence
|
||||
* trusted.
|
||||
*
|
||||
* @param {!goog.string.Const} url A compile-time-constant string from which to
|
||||
* create a SafeUrl.
|
||||
* @return {!goog.html.SafeUrl} A SafeUrl object initialized to {@code url}.
|
||||
*/
|
||||
goog.html.SafeUrl.fromConstant = function(url) {
|
||||
return goog.html.SafeUrl.createSafeUrlSecurityPrivateDoNotAccessOrElse(
|
||||
goog.string.Const.unwrap(url));
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* A pattern that matches Blob or data types that can have SafeUrls created
|
||||
* from URL.createObjectURL(blob) or via a data: URI. Only matches image and
|
||||
* video types, currently.
|
||||
* @const
|
||||
* @private
|
||||
*/
|
||||
goog.html.SAFE_MIME_TYPE_PATTERN_ =
|
||||
/^(?:image\/(?:bmp|gif|jpeg|jpg|png|tiff|webp)|video\/(?:mpeg|mp4|ogg|webm))$/i;
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeUrl wrapping a blob URL for the given {@code blob}.
|
||||
*
|
||||
* The blob URL is created with {@code URL.createObjectURL}. If the MIME type
|
||||
* for {@code blob} is not of a known safe image or video MIME type, then the
|
||||
* SafeUrl will wrap {@link #INNOCUOUS_STRING}.
|
||||
*
|
||||
* @see http://www.w3.org/TR/FileAPI/#url
|
||||
* @param {!Blob} blob
|
||||
* @return {!goog.html.SafeUrl} The blob URL, or an innocuous string wrapped
|
||||
* as a SafeUrl.
|
||||
*/
|
||||
goog.html.SafeUrl.fromBlob = function(blob) {
|
||||
var url = goog.html.SAFE_MIME_TYPE_PATTERN_.test(blob.type) ?
|
||||
goog.fs.url.createObjectUrl(blob) :
|
||||
goog.html.SafeUrl.INNOCUOUS_STRING;
|
||||
return goog.html.SafeUrl.createSafeUrlSecurityPrivateDoNotAccessOrElse(url);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Matches a base-64 data URL, with the first match group being the MIME type.
|
||||
* @const
|
||||
* @private
|
||||
*/
|
||||
goog.html.DATA_URL_PATTERN_ = /^data:([^;,]*);base64,[a-z0-9+\/]+=*$/i;
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeUrl wrapping a data: URL, after validating it matches a
|
||||
* known-safe image or video MIME type.
|
||||
*
|
||||
* @param {string} dataUrl A valid base64 data URL with one of the whitelisted
|
||||
* image or video MIME types.
|
||||
* @return {!goog.html.SafeUrl} A matching safe URL, or {@link INNOCUOUS_STRING}
|
||||
* wrapped as a SafeUrl if it does not pass.
|
||||
*/
|
||||
goog.html.SafeUrl.fromDataUrl = function(dataUrl) {
|
||||
// There's a slight risk here that a browser sniffs the content type if it
|
||||
// doesn't know the MIME type and executes HTML within the data: URL. For this
|
||||
// to cause XSS it would also have to execute the HTML in the same origin
|
||||
// of the page with the link. It seems unlikely that both of these will
|
||||
// happen, particularly in not really old IEs.
|
||||
var match = dataUrl.match(goog.html.DATA_URL_PATTERN_);
|
||||
var valid = match && goog.html.SAFE_MIME_TYPE_PATTERN_.test(match[1]);
|
||||
return goog.html.SafeUrl.createSafeUrlSecurityPrivateDoNotAccessOrElse(
|
||||
valid ? dataUrl : goog.html.SafeUrl.INNOCUOUS_STRING);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeUrl wrapping a tel: URL.
|
||||
*
|
||||
* @param {string} telUrl A tel URL.
|
||||
* @return {!goog.html.SafeUrl} A matching safe URL, or {@link INNOCUOUS_STRING}
|
||||
* wrapped as a SafeUrl if it does not pass.
|
||||
*/
|
||||
goog.html.SafeUrl.fromTelUrl = function(telUrl) {
|
||||
// There's a risk that a tel: URL could immediately place a call once
|
||||
// clicked, without requiring user confirmation. For that reason it is
|
||||
// handled in this separate function.
|
||||
if (!goog.string.caseInsensitiveStartsWith(telUrl, 'tel:')) {
|
||||
telUrl = goog.html.SafeUrl.INNOCUOUS_STRING;
|
||||
}
|
||||
return goog.html.SafeUrl.createSafeUrlSecurityPrivateDoNotAccessOrElse(
|
||||
telUrl);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* A pattern that recognizes a commonly useful subset of URLs that satisfy
|
||||
* the SafeUrl contract.
|
||||
*
|
||||
* This regular expression matches a subset of URLs that will not cause script
|
||||
* execution if used in URL context within a HTML document. Specifically, this
|
||||
* regular expression matches if (comment from here on and regex copied from
|
||||
* Soy's EscapingConventions):
|
||||
* (1) Either a protocol in a whitelist (http, https, mailto or ftp).
|
||||
* (2) or no protocol. A protocol must be followed by a colon. The below
|
||||
* allows that by allowing colons only after one of the characters [/?#].
|
||||
* A colon after a hash (#) must be in the fragment.
|
||||
* Otherwise, a colon after a (?) must be in a query.
|
||||
* Otherwise, a colon after a single solidus (/) must be in a path.
|
||||
* Otherwise, a colon after a double solidus (//) must be in the authority
|
||||
* (before port).
|
||||
*
|
||||
* The pattern disallows &, used in HTML entity declarations before
|
||||
* one of the characters in [/?#]. This disallows HTML entities used in the
|
||||
* protocol name, which should never happen, e.g. "http" for "http".
|
||||
* It also disallows HTML entities in the first path part of a relative path,
|
||||
* e.g. "foo<bar/baz". Our existing escaping functions should not produce
|
||||
* that. More importantly, it disallows masking of a colon,
|
||||
* e.g. "javascript:...".
|
||||
*
|
||||
* @private
|
||||
* @const {!RegExp}
|
||||
*/
|
||||
goog.html.SAFE_URL_PATTERN_ =
|
||||
/^(?:(?:https?|mailto|ftp):|[^&:/?#]*(?:[/?#]|$))/i;
|
||||
|
||||
|
||||
/**
|
||||
* Creates a SafeUrl object from {@code url}. If {@code url} is a
|
||||
* goog.html.SafeUrl then it is simply returned. Otherwise the input string is
|
||||
* validated to match a pattern of commonly used safe URLs.
|
||||
*
|
||||
* {@code url} may be a URL with the http, https, mailto or ftp scheme,
|
||||
* or a relative URL (i.e., a URL without a scheme; specifically, a
|
||||
* scheme-relative, absolute-path-relative, or path-relative URL).
|
||||
*
|
||||
* @see http://url.spec.whatwg.org/#concept-relative-url
|
||||
* @param {string|!goog.string.TypedString} url The URL to validate.
|
||||
* @return {!goog.html.SafeUrl} The validated URL, wrapped as a SafeUrl.
|
||||
*/
|
||||
goog.html.SafeUrl.sanitize = function(url) {
|
||||
if (url instanceof goog.html.SafeUrl) {
|
||||
return url;
|
||||
} else if (url.implementsGoogStringTypedString) {
|
||||
url = url.getTypedStringValue();
|
||||
} else {
|
||||
url = String(url);
|
||||
}
|
||||
if (!goog.html.SAFE_URL_PATTERN_.test(url)) {
|
||||
url = goog.html.SafeUrl.INNOCUOUS_STRING;
|
||||
}
|
||||
return goog.html.SafeUrl.createSafeUrlSecurityPrivateDoNotAccessOrElse(url);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Type marker for the SafeUrl type, used to implement additional run-time
|
||||
* type checking.
|
||||
* @const {!Object}
|
||||
* @private
|
||||
*/
|
||||
goog.html.SafeUrl.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ = {};
|
||||
|
||||
|
||||
/**
|
||||
* Package-internal utility method to create SafeUrl instances.
|
||||
*
|
||||
* @param {string} url The string to initialize the SafeUrl object with.
|
||||
* @return {!goog.html.SafeUrl} The initialized SafeUrl object.
|
||||
* @package
|
||||
*/
|
||||
goog.html.SafeUrl.createSafeUrlSecurityPrivateDoNotAccessOrElse = function(
|
||||
url) {
|
||||
var safeUrl = new goog.html.SafeUrl();
|
||||
safeUrl.privateDoNotAccessOrElseSafeHtmlWrappedValue_ = url;
|
||||
return safeUrl;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* A SafeUrl corresponding to the special about:blank url.
|
||||
* @const {!goog.html.SafeUrl}
|
||||
*/
|
||||
goog.html.SafeUrl.ABOUT_BLANK =
|
||||
goog.html.SafeUrl.createSafeUrlSecurityPrivateDoNotAccessOrElse(
|
||||
'about:blank');
|
||||
244
resources/public/js/compiled/out/goog/html/trustedresourceurl.js
Normal file
244
resources/public/js/compiled/out/goog/html/trustedresourceurl.js
Normal file
|
|
@ -0,0 +1,244 @@
|
|||
// Copyright 2013 The Closure Library Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS-IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
/**
|
||||
* @fileoverview The TrustedResourceUrl type and its builders.
|
||||
*
|
||||
* TODO(xtof): Link to document stating type contract.
|
||||
*/
|
||||
|
||||
goog.provide('goog.html.TrustedResourceUrl');
|
||||
|
||||
goog.require('goog.asserts');
|
||||
goog.require('goog.i18n.bidi.Dir');
|
||||
goog.require('goog.i18n.bidi.DirectionalString');
|
||||
goog.require('goog.string.Const');
|
||||
goog.require('goog.string.TypedString');
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* A URL which is under application control and from which script, CSS, and
|
||||
* other resources that represent executable code, can be fetched.
|
||||
*
|
||||
* Given that the URL can only be constructed from strings under application
|
||||
* control and is used to load resources, bugs resulting in a malformed URL
|
||||
* should not have a security impact and are likely to be easily detectable
|
||||
* during testing. Given the wide number of non-RFC compliant URLs in use,
|
||||
* stricter validation could prevent some applications from being able to use
|
||||
* this type.
|
||||
*
|
||||
* Instances of this type must be created via the factory method,
|
||||
* ({@code goog.html.TrustedResourceUrl.fromConstant}), and not by invoking its
|
||||
* constructor. The constructor intentionally takes no parameters and the type
|
||||
* is immutable; hence only a default instance corresponding to the empty
|
||||
* string can be obtained via constructor invocation.
|
||||
*
|
||||
* @see goog.html.TrustedResourceUrl#fromConstant
|
||||
* @constructor
|
||||
* @final
|
||||
* @struct
|
||||
* @implements {goog.i18n.bidi.DirectionalString}
|
||||
* @implements {goog.string.TypedString}
|
||||
*/
|
||||
goog.html.TrustedResourceUrl = function() {
|
||||
/**
|
||||
* The contained value of this TrustedResourceUrl. The field has a purposely
|
||||
* ugly name to make (non-compiled) code that attempts to directly access this
|
||||
* field stand out.
|
||||
* @private {string}
|
||||
*/
|
||||
this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_ = '';
|
||||
|
||||
/**
|
||||
* A type marker used to implement additional run-time type checking.
|
||||
* @see goog.html.TrustedResourceUrl#unwrap
|
||||
* @const
|
||||
* @private
|
||||
*/
|
||||
this.TRUSTED_RESOURCE_URL_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ =
|
||||
goog.html.TrustedResourceUrl.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @override
|
||||
* @const
|
||||
*/
|
||||
goog.html.TrustedResourceUrl.prototype.implementsGoogStringTypedString = true;
|
||||
|
||||
|
||||
/**
|
||||
* Returns this TrustedResourceUrl's value as a string.
|
||||
*
|
||||
* IMPORTANT: In code where it is security relevant that an object's type is
|
||||
* indeed {@code TrustedResourceUrl}, use
|
||||
* {@code goog.html.TrustedResourceUrl.unwrap} instead of this method. If in
|
||||
* doubt, assume that it's security relevant. In particular, note that
|
||||
* goog.html functions which return a goog.html type do not guarantee that
|
||||
* the returned instance is of the right type. For example:
|
||||
*
|
||||
* <pre>
|
||||
* var fakeSafeHtml = new String('fake');
|
||||
* fakeSafeHtml.__proto__ = goog.html.SafeHtml.prototype;
|
||||
* var newSafeHtml = goog.html.SafeHtml.htmlEscape(fakeSafeHtml);
|
||||
* // newSafeHtml is just an alias for fakeSafeHtml, it's passed through by
|
||||
* // goog.html.SafeHtml.htmlEscape() as fakeSafeHtml instanceof
|
||||
* // goog.html.SafeHtml.
|
||||
* </pre>
|
||||
*
|
||||
* @see goog.html.TrustedResourceUrl#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.TrustedResourceUrl.prototype.getTypedStringValue = function() {
|
||||
return this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @override
|
||||
* @const
|
||||
*/
|
||||
goog.html.TrustedResourceUrl.prototype.implementsGoogI18nBidiDirectionalString =
|
||||
true;
|
||||
|
||||
|
||||
/**
|
||||
* Returns this URLs directionality, which is always {@code LTR}.
|
||||
* @override
|
||||
*/
|
||||
goog.html.TrustedResourceUrl.prototype.getDirection = function() {
|
||||
return goog.i18n.bidi.Dir.LTR;
|
||||
};
|
||||
|
||||
|
||||
if (goog.DEBUG) {
|
||||
/**
|
||||
* Returns a debug string-representation of this value.
|
||||
*
|
||||
* To obtain the actual string value wrapped in a TrustedResourceUrl, use
|
||||
* {@code goog.html.TrustedResourceUrl.unwrap}.
|
||||
*
|
||||
* @see goog.html.TrustedResourceUrl#unwrap
|
||||
* @override
|
||||
*/
|
||||
goog.html.TrustedResourceUrl.prototype.toString = function() {
|
||||
return 'TrustedResourceUrl{' +
|
||||
this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_ + '}';
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Performs a runtime check that the provided object is indeed a
|
||||
* TrustedResourceUrl object, and returns its value.
|
||||
*
|
||||
* @param {!goog.html.TrustedResourceUrl} trustedResourceUrl The object to
|
||||
* extract from.
|
||||
* @return {string} The trustedResourceUrl object's contained string, unless
|
||||
* the run-time type check fails. In that case, {@code unwrap} returns an
|
||||
* innocuous string, or, if assertions are enabled, throws
|
||||
* {@code goog.asserts.AssertionError}.
|
||||
*/
|
||||
goog.html.TrustedResourceUrl.unwrap = function(trustedResourceUrl) {
|
||||
// Perform additional Run-time type-checking to ensure that
|
||||
// trustedResourceUrl is indeed an instance of the expected type. This
|
||||
// provides some additional protection against security bugs due to
|
||||
// application code that disables type checks.
|
||||
// Specifically, the following checks are performed:
|
||||
// 1. The object is an instance of the expected type.
|
||||
// 2. The object is not an instance of a subclass.
|
||||
// 3. The object carries a type marker for the expected type. "Faking" an
|
||||
// object requires a reference to the type marker, which has names intended
|
||||
// to stand out in code reviews.
|
||||
if (trustedResourceUrl instanceof goog.html.TrustedResourceUrl &&
|
||||
trustedResourceUrl.constructor === goog.html.TrustedResourceUrl &&
|
||||
trustedResourceUrl
|
||||
.TRUSTED_RESOURCE_URL_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ ===
|
||||
goog.html.TrustedResourceUrl
|
||||
.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_) {
|
||||
return trustedResourceUrl
|
||||
.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_;
|
||||
} else {
|
||||
goog.asserts.fail('expected object of type TrustedResourceUrl, got \'' +
|
||||
trustedResourceUrl + '\' of type ' + goog.typeOf(trustedResourceUrl));
|
||||
return 'type_error:TrustedResourceUrl';
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a TrustedResourceUrl object from a compile-time constant string.
|
||||
*
|
||||
* Compile-time constant strings are inherently program-controlled and hence
|
||||
* trusted.
|
||||
*
|
||||
* @param {!goog.string.Const} url A compile-time-constant string from which to
|
||||
* create a TrustedResourceUrl.
|
||||
* @return {!goog.html.TrustedResourceUrl} A TrustedResourceUrl object
|
||||
* initialized to {@code url}.
|
||||
*/
|
||||
goog.html.TrustedResourceUrl.fromConstant = function(url) {
|
||||
return goog.html.TrustedResourceUrl
|
||||
.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(
|
||||
goog.string.Const.unwrap(url));
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Creates a TrustedResourceUrl object from a compile-time constant strings.
|
||||
*
|
||||
* Compile-time constant strings are inherently program-controlled and hence
|
||||
* trusted.
|
||||
*
|
||||
* @param {!Array<!goog.string.Const>} parts Compile-time-constant strings from
|
||||
* which to create a TrustedResourceUrl.
|
||||
* @return {!goog.html.TrustedResourceUrl} A TrustedResourceUrl object
|
||||
* initialized to concatenation of {@code parts}.
|
||||
*/
|
||||
goog.html.TrustedResourceUrl.fromConstants = function(parts) {
|
||||
var unwrapped = '';
|
||||
for (var i = 0; i < parts.length; i++) {
|
||||
unwrapped += goog.string.Const.unwrap(parts[i]);
|
||||
}
|
||||
return goog.html.TrustedResourceUrl
|
||||
.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(unwrapped);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Type marker for the TrustedResourceUrl type, used to implement additional
|
||||
* run-time type checking.
|
||||
* @const {!Object}
|
||||
* @private
|
||||
*/
|
||||
goog.html.TrustedResourceUrl.TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ = {};
|
||||
|
||||
|
||||
/**
|
||||
* Package-internal utility method to create TrustedResourceUrl instances.
|
||||
*
|
||||
* @param {string} url The string to initialize the TrustedResourceUrl object
|
||||
* with.
|
||||
* @return {!goog.html.TrustedResourceUrl} The initialized TrustedResourceUrl
|
||||
* object.
|
||||
* @package
|
||||
*/
|
||||
goog.html.TrustedResourceUrl
|
||||
.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse = function(url) {
|
||||
var trustedResourceUrl = new goog.html.TrustedResourceUrl();
|
||||
trustedResourceUrl.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_ =
|
||||
url;
|
||||
return trustedResourceUrl;
|
||||
};
|
||||
|
|
@ -0,0 +1,232 @@
|
|||
// Copyright 2013 The Closure Library Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS-IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
/**
|
||||
* @fileoverview Unchecked conversions to create values of goog.html types from
|
||||
* plain strings. Use of these functions could potentially result in instances
|
||||
* of goog.html types that violate their type contracts, and hence result in
|
||||
* security vulnerabilties.
|
||||
*
|
||||
* Therefore, all uses of the methods herein must be carefully security
|
||||
* reviewed. Avoid use of the methods in this file whenever possible; instead
|
||||
* prefer to create instances of goog.html types using inherently safe builders
|
||||
* or template systems.
|
||||
*
|
||||
*
|
||||
*
|
||||
* @visibility {//closure/goog/html:approved_for_unchecked_conversion}
|
||||
* @visibility {//closure/goog/bin/sizetests:__pkg__}
|
||||
*/
|
||||
|
||||
|
||||
goog.provide('goog.html.uncheckedconversions');
|
||||
|
||||
goog.require('goog.asserts');
|
||||
goog.require('goog.html.SafeHtml');
|
||||
goog.require('goog.html.SafeScript');
|
||||
goog.require('goog.html.SafeStyle');
|
||||
goog.require('goog.html.SafeStyleSheet');
|
||||
goog.require('goog.html.SafeUrl');
|
||||
goog.require('goog.html.TrustedResourceUrl');
|
||||
goog.require('goog.string');
|
||||
goog.require('goog.string.Const');
|
||||
|
||||
|
||||
/**
|
||||
* Performs an "unchecked conversion" to SafeHtml from a plain string that is
|
||||
* known to satisfy the SafeHtml type contract.
|
||||
*
|
||||
* IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
|
||||
* that the value of {@code html} satisfies the SafeHtml type contract in all
|
||||
* possible program states.
|
||||
*
|
||||
*
|
||||
* @param {!goog.string.Const} justification A constant string explaining why
|
||||
* this use of this method is safe. May include a security review ticket
|
||||
* number.
|
||||
* @param {string} html A string that is claimed to adhere to the SafeHtml
|
||||
* contract.
|
||||
* @param {?goog.i18n.bidi.Dir=} opt_dir The optional directionality of the
|
||||
* SafeHtml to be constructed. A null or undefined value signifies an
|
||||
* unknown directionality.
|
||||
* @return {!goog.html.SafeHtml} The value of html, wrapped in a SafeHtml
|
||||
* object.
|
||||
* @suppress {visibility} For access to SafeHtml.create... Note that this
|
||||
* use is appropriate since this method is intended to be "package private"
|
||||
* within goog.html. DO NOT call SafeHtml.create... from outside this
|
||||
* package; use appropriate wrappers instead.
|
||||
*/
|
||||
goog.html.uncheckedconversions.safeHtmlFromStringKnownToSatisfyTypeContract =
|
||||
function(justification, html, opt_dir) {
|
||||
// unwrap() called inside an assert so that justification can be optimized
|
||||
// away in production code.
|
||||
goog.asserts.assertString(
|
||||
goog.string.Const.unwrap(justification), 'must provide justification');
|
||||
goog.asserts.assert(
|
||||
!goog.string.isEmptyOrWhitespace(goog.string.Const.unwrap(justification)),
|
||||
'must provide non-empty justification');
|
||||
return goog.html.SafeHtml.createSafeHtmlSecurityPrivateDoNotAccessOrElse(
|
||||
html, opt_dir || null);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Performs an "unchecked conversion" to SafeScript from a plain string that is
|
||||
* known to satisfy the SafeScript type contract.
|
||||
*
|
||||
* IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
|
||||
* that the value of {@code script} satisfies the SafeScript type contract in
|
||||
* all possible program states.
|
||||
*
|
||||
*
|
||||
* @param {!goog.string.Const} justification A constant string explaining why
|
||||
* this use of this method is safe. May include a security review ticket
|
||||
* number.
|
||||
* @param {string} script The string to wrap as a SafeScript.
|
||||
* @return {!goog.html.SafeScript} The value of {@code script}, wrapped in a
|
||||
* SafeScript object.
|
||||
*/
|
||||
goog.html.uncheckedconversions.safeScriptFromStringKnownToSatisfyTypeContract =
|
||||
function(justification, script) {
|
||||
// unwrap() called inside an assert so that justification can be optimized
|
||||
// away in production code.
|
||||
goog.asserts.assertString(
|
||||
goog.string.Const.unwrap(justification), 'must provide justification');
|
||||
goog.asserts.assert(
|
||||
!goog.string.isEmpty(goog.string.Const.unwrap(justification)),
|
||||
'must provide non-empty justification');
|
||||
return goog.html.SafeScript.createSafeScriptSecurityPrivateDoNotAccessOrElse(
|
||||
script);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Performs an "unchecked conversion" to SafeStyle from a plain string that is
|
||||
* known to satisfy the SafeStyle type contract.
|
||||
*
|
||||
* IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
|
||||
* that the value of {@code style} satisfies the SafeUrl type contract in all
|
||||
* possible program states.
|
||||
*
|
||||
*
|
||||
* @param {!goog.string.Const} justification A constant string explaining why
|
||||
* this use of this method is safe. May include a security review ticket
|
||||
* number.
|
||||
* @param {string} style The string to wrap as a SafeStyle.
|
||||
* @return {!goog.html.SafeStyle} The value of {@code style}, wrapped in a
|
||||
* SafeStyle object.
|
||||
*/
|
||||
goog.html.uncheckedconversions.safeStyleFromStringKnownToSatisfyTypeContract =
|
||||
function(justification, style) {
|
||||
// unwrap() called inside an assert so that justification can be optimized
|
||||
// away in production code.
|
||||
goog.asserts.assertString(
|
||||
goog.string.Const.unwrap(justification), 'must provide justification');
|
||||
goog.asserts.assert(
|
||||
!goog.string.isEmptyOrWhitespace(goog.string.Const.unwrap(justification)),
|
||||
'must provide non-empty justification');
|
||||
return goog.html.SafeStyle.createSafeStyleSecurityPrivateDoNotAccessOrElse(
|
||||
style);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Performs an "unchecked conversion" to SafeStyleSheet from a plain string
|
||||
* that is known to satisfy the SafeStyleSheet type contract.
|
||||
*
|
||||
* IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
|
||||
* that the value of {@code styleSheet} satisfies the SafeUrl type contract in
|
||||
* all possible program states.
|
||||
*
|
||||
*
|
||||
* @param {!goog.string.Const} justification A constant string explaining why
|
||||
* this use of this method is safe. May include a security review ticket
|
||||
* number.
|
||||
* @param {string} styleSheet The string to wrap as a SafeStyleSheet.
|
||||
* @return {!goog.html.SafeStyleSheet} The value of {@code styleSheet}, wrapped
|
||||
* in a SafeStyleSheet object.
|
||||
*/
|
||||
goog.html.uncheckedconversions
|
||||
.safeStyleSheetFromStringKnownToSatisfyTypeContract = function(
|
||||
justification, styleSheet) {
|
||||
// unwrap() called inside an assert so that justification can be optimized
|
||||
// away in production code.
|
||||
goog.asserts.assertString(
|
||||
goog.string.Const.unwrap(justification), 'must provide justification');
|
||||
goog.asserts.assert(
|
||||
!goog.string.isEmptyOrWhitespace(goog.string.Const.unwrap(justification)),
|
||||
'must provide non-empty justification');
|
||||
return goog.html.SafeStyleSheet
|
||||
.createSafeStyleSheetSecurityPrivateDoNotAccessOrElse(styleSheet);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Performs an "unchecked conversion" to SafeUrl from a plain string that is
|
||||
* known to satisfy the SafeUrl type contract.
|
||||
*
|
||||
* IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
|
||||
* that the value of {@code url} satisfies the SafeUrl type contract in all
|
||||
* possible program states.
|
||||
*
|
||||
*
|
||||
* @param {!goog.string.Const} justification A constant string explaining why
|
||||
* this use of this method is safe. May include a security review ticket
|
||||
* number.
|
||||
* @param {string} url The string to wrap as a SafeUrl.
|
||||
* @return {!goog.html.SafeUrl} The value of {@code url}, wrapped in a SafeUrl
|
||||
* object.
|
||||
*/
|
||||
goog.html.uncheckedconversions.safeUrlFromStringKnownToSatisfyTypeContract =
|
||||
function(justification, url) {
|
||||
// unwrap() called inside an assert so that justification can be optimized
|
||||
// away in production code.
|
||||
goog.asserts.assertString(
|
||||
goog.string.Const.unwrap(justification), 'must provide justification');
|
||||
goog.asserts.assert(
|
||||
!goog.string.isEmptyOrWhitespace(goog.string.Const.unwrap(justification)),
|
||||
'must provide non-empty justification');
|
||||
return goog.html.SafeUrl.createSafeUrlSecurityPrivateDoNotAccessOrElse(url);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Performs an "unchecked conversion" to TrustedResourceUrl from a plain string
|
||||
* that is known to satisfy the TrustedResourceUrl type contract.
|
||||
*
|
||||
* IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
|
||||
* that the value of {@code url} satisfies the TrustedResourceUrl type contract
|
||||
* in all possible program states.
|
||||
*
|
||||
*
|
||||
* @param {!goog.string.Const} justification A constant string explaining why
|
||||
* this use of this method is safe. May include a security review ticket
|
||||
* number.
|
||||
* @param {string} url The string to wrap as a TrustedResourceUrl.
|
||||
* @return {!goog.html.TrustedResourceUrl} The value of {@code url}, wrapped in
|
||||
* a TrustedResourceUrl object.
|
||||
*/
|
||||
goog.html.uncheckedconversions
|
||||
.trustedResourceUrlFromStringKnownToSatisfyTypeContract = function(
|
||||
justification, url) {
|
||||
// unwrap() called inside an assert so that justification can be optimized
|
||||
// away in production code.
|
||||
goog.asserts.assertString(
|
||||
goog.string.Const.unwrap(justification), 'must provide justification');
|
||||
goog.asserts.assert(
|
||||
!goog.string.isEmptyOrWhitespace(goog.string.Const.unwrap(justification)),
|
||||
'must provide non-empty justification');
|
||||
return goog.html.TrustedResourceUrl
|
||||
.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(url);
|
||||
};
|
||||
Loading…
Add table
Add a link
Reference in a new issue