Compare text

Find the difference between two text files

Real-time diff

Unified diff

Collapse lines

Highlight change

Syntax highlighting

Tools

parse_html_subset.diff

Created 3 years agoDiff never expires

64 removals

185 lines

129 additions

253 lines

// Use of this source code is governed by a BSD-style license that can be

// found in the LICENSE file.

/**

* Parses a very small subset of HTML. This ensures that insecure HTML /

* javascript cannot be injected into WebUI.

* @param {string} s The string to parse.

* @param {!Array<string>=} opt_extraTags Optional extra allowed tags.

* @param {!Array<string>=} opt_extraAttrs

* Optional extra allowed attributes (all tags are run through these).

* @throws {Error} In case of non supported markup.

* @return {DocumentFragment} A document fragment containing the DOM tree.

/* #export */ const parseHtmlSubset = (function() {

'use strict';

/** @typedef {function(!Node, string):boolean} */

let AllowFunction;

/** @type {!AllowFunction} */

const allowAttribute = (node, value) => true;

/**

* Allow-list of attributes in parseHtmlSubset.

* @type {!Map<string, !AllowFunction>}

* @const

const allowedAttributes = new Map([

[

'href',

(node, value) => {

// Only allow a[href] starting with chrome:// and https://

return node.tagName === 'A' &&

(value.startsWith('chrome://') || value.startsWith('https://'));

}

[

'target',

(node, value) => {

// Only allow a[target='_blank'].

// TODO(dbeam): are there valid use cases for target !== '_blank'?

return node.tagName === 'A' && value === '_blank';

}

]);

/**

* Allow-list of optional attributes in parseHtmlSubset.

* @type {!Map<string, !AllowFunction>}

* @const

const allowedOptionalAttributes = new Map([

['class', allowAttribute],

['id', allowAttribute],

['is', (node, value) => value === 'action-link' || value === ''],

['role', (node, value) => value === 'link'],

[

'src',

(node, value) => {

// Only allow img[src] starting with chrome://

// Only allow iframe[src] starting with https://

return node.tagName === 'IMG' && value.startsWith('chrome://');

return node.tagName === 'IFRAME' && value.startsWith('https://');

}

['tabindex', allowAttribute],

]);

/**

* Allow-list of tag names in parseHtmlSubset.

* @type {!Set<string>}

* @const

// Let's allow all HTML tags supported in DOMPurify + iframe, but except style :)

const allowedTags =

new Set(['A', 'B', 'BR', 'DIV', 'P', 'PRE', 'SPAN', 'STRONG']);

new Set([ 'A',

'ABBR',

/**

'ACRONYM',

* Allow-list of optional tag names in parseHtmlSubset.

'ADDRESS',

* @type {!Set<string>}

'AREA',

* @const

'ARTICLE',

'ASIDE',

const allowedOptionalTags = new Set(['IMG']);

'AUDIO',

'B',

'BDI',

'BDO',

'BIG',

'BLINK',

'BLOCKQUOTE',

'BODY',

'BR',

'BUTTON',

'CANVAS',

'CAPTION',

'CENTER',

'CITE',

'CODE',

'COL',

'COLGROUP',

'CONTENT',

'DATA',

'DATALIST',

'DD',

'DECORATOR',

'DEL',

'DETAILS',

'DFN',

'DIALOG',

'DIR',

'DIV',

'DL',

'DT',

'ELEMENT',

'EM',

'FIELDSET',

'FIGCAPTION',

'FIGURE',

'FONT',

'FOOTER',

'FORM',

'H1',

'H2',

'H3',

'H4',

'H5',

'H6',

'HEAD',

'HEADER',

'HGROUP',

'HR',

'HTML',

'I',

'IFRAME',

'IMG',

'INPUT',

'INS',

'KBD',

'LABEL',

'LEGEND',

'LI',

'MAIN',

'MAP',

'MARK',

'MARQUEE',

'MENU',

'MENUITEM',

'METER',

'NAV',

'NOBR',

'OL',

'OPTGROUP',

'OPTION',

'OUTPUT',

'P',

'PICTURE',

'PRE',

'PROGRESS',

'Q',

'RP',

'RT',

'RUBY',

'S',

'SAMP',

'SECTION',

'SELECT',

'SHADOW',

'SMALL',

'SOURCE',

'SPACER',

'SPAN',

'STRIKE',

'STRONG',

'SUB',

'SUMMARY',

'SUP',

'TABLE',

'TBODY',

'TD',

'TEMPLATE',

'TEXTAREA',

'TFOOT',

'TH',

'THEAD',

'TIME',

'TR',

'TRACK',

'TT',

'U',

'UL',

'VAR',

'VIDEO',

'WBR']);

/**

* This policy maps a given string to a `TrustedHTML` object

* without performing any validation. Callsites must ensure

* that the resulting object will only be used in inert

* documents. Initialized lazily.

* @type {!TrustedTypePolicy}

let unsanitizedPolicy;

/**

* @param {!Array<string>} optTags an Array to merge.

* @return {!Set<string>} Set of allowed tags.

function mergeTags(optTags) {

const clone = new Set(allowedTags);

optTags.forEach(str => {

const tag = str.toUpperCase();

if (allowedOptionalTags.has(tag)) {

clone.add(tag);

}

});

return clone;

}

/**

* @param {!Array<string>} optAttrs an Array to merge.

* @return {!Map<string, !AllowFunction>} Map of allowed

* attributes.

function mergeAttrs(optAttrs) {

const clone = new Map([...allowedAttributes]);

optAttrs.forEach(key => {

if (allowedOptionalAttributes.has(key)) {

clone.set(key, allowedOptionalAttributes.get(key));

}

});

return clone;

}

function walk(n, f) {

f(n);

for (let i = 0; i < n.childNodes.length; i++) {

walk(n.childNodes[i], f);

}

function assertElement(tags, node) {

if (!tags.has(node.tagName)) {

throw Error(node.tagName + ' is not supported');

}

function assertAttribute(attrs, attrNode, node) {

const n = attrNode.nodeName;

const v = attrNode.nodeValue;

if (!attrs.has(n) || !attrs.get(n)(node, v)) {

throw Error(node.tagName + '[' + n + '="' + v + '"] is not supported');

}

return function(s, opt_extraTags, opt_extraAttrs) {

return function(s) {

const tags = opt_extraTags ? mergeTags(opt_extraTags) : allowedTags;

const tags = allowedTags;

const attrs =

const attrs = allowedAttributes;

opt_extraAttrs ? mergeAttrs(opt_extraAttrs) : allowedAttributes;

const doc = document.implementation.createHTMLDocument('');

const r = doc.createRange();

r.selectNode(doc.body);

if (window.trustedTypes) {

if (!unsanitizedPolicy) {

unsanitizedPolicy = trustedTypes.createPolicy(

'parse-html-subset', {createHTML: untrustedHTML => untrustedHTML});

}

s = unsanitizedPolicy.createHTML(s);

}

// This does not execute any scripts because the document has no view.

const df = r.createContextualFragment(s);

walk(df, function(node) {

switch (node.nodeType) {

case Node.ELEMENT_NODE:

assertElement(tags, node);

const nodeAttrs = node.attributes;

for (let i = 0; i < nodeAttrs.length; ++i) {

assertAttribute(attrs, nodeAttrs[i], node);

}

break;

case Node.COMMENT_NODE:

case Node.DOCUMENT_FRAGMENT_NODE:

case Node.TEXT_NODE:

break;

default:

throw Error('Node type ' + node.nodeType + ' is not supported');

}

});

return df;

};

})();

/* #ignore */ console.warn('crbug/1173575, non-JS module files deprecated.');

Saved diffs

Original text

Open file

// Copyright (c) 2012 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

/**
 * Parses a very small subset of HTML. This ensures that insecure HTML /
 * javascript cannot be injected into WebUI.
 * @param {string} s The string to parse.
 * @param {!Array<string>=} opt_extraTags Optional extra allowed tags.
 * @param {!Array<string>=} opt_extraAttrs
 *     Optional extra allowed attributes (all tags are run through these).
 * @throws {Error} In case of non supported markup.
 * @return {DocumentFragment} A document fragment containing the DOM tree.
 */
/* #export */ const parseHtmlSubset = (function() {
  'use strict';

  /** @typedef {function(!Node, string):boolean} */
  let AllowFunction;

  /** @type {!AllowFunction} */
  const allowAttribute = (node, value) => true;

  /**
   * Allow-list of attributes in parseHtmlSubset.
   * @type {!Map<string, !AllowFunction>}
   * @const
   */
  const allowedAttributes = new Map([
    [
      'href',
      (node, value) => {
        // Only allow a[href] starting with chrome:// and https://
        return node.tagName === 'A' &&
            (value.startsWith('chrome://') || value.startsWith('https://'));
      }
    ],
    [
      'target',
      (node, value) => {
        // Only allow a[target='_blank'].
        // TODO(dbeam): are there valid use cases for target !== '_blank'?
        return node.tagName === 'A' && value === '_blank';
      }
    ],
  ]);

  /**
   * Allow-list of optional attributes in parseHtmlSubset.
   * @type {!Map<string, !AllowFunction>}
   * @const
   */
  const allowedOptionalAttributes = new Map([
    ['class', allowAttribute],
    ['id', allowAttribute],
    ['is', (node, value) => value === 'action-link' || value === ''],
    ['role', (node, value) => value === 'link'],
    [
      'src',
      (node, value) => {
        // Only allow img[src] starting with chrome://
        return node.tagName === 'IMG' && value.startsWith('chrome://');
      }
    ],
    ['tabindex', allowAttribute],
  ]);

  /**
   * Allow-list of tag names in parseHtmlSubset.
   * @type {!Set<string>}
   * @const
   */
  const allowedTags =
      new Set(['A', 'B', 'BR', 'DIV', 'P', 'PRE', 'SPAN', 'STRONG']);

  /**
   * Allow-list of optional tag names in parseHtmlSubset.
   * @type {!Set<string>}
   * @const
   */
  const allowedOptionalTags = new Set(['IMG']);

  /**
   * This policy maps a given string to a `TrustedHTML` object
   * without performing any validation. Callsites must ensure
   * that the resulting object will only be used in inert
   * documents. Initialized lazily.
   * @type {!TrustedTypePolicy}
   */
  let unsanitizedPolicy;

  /**
   * @param {!Array<string>} optTags an Array to merge.
   * @return {!Set<string>} Set of allowed tags.
   */
  function mergeTags(optTags) {
    const clone = new Set(allowedTags);
    optTags.forEach(str => {
      const tag = str.toUpperCase();
      if (allowedOptionalTags.has(tag)) {
        clone.add(tag);
      }
    });
    return clone;
  }

  /**
   * @param {!Array<string>} optAttrs an Array to merge.
   * @return {!Map<string, !AllowFunction>} Map of allowed
   *     attributes.
   */
  function mergeAttrs(optAttrs) {
    const clone = new Map([...allowedAttributes]);
    optAttrs.forEach(key => {
      if (allowedOptionalAttributes.has(key)) {
        clone.set(key, allowedOptionalAttributes.get(key));
      }
    });
    return clone;
  }

  function walk(n, f) {
    f(n);
    for (let i = 0; i < n.childNodes.length; i++) {
      walk(n.childNodes[i], f);
    }
  }

  function assertElement(tags, node) {
    if (!tags.has(node.tagName)) {
      throw Error(node.tagName + ' is not supported');
    }
  }

  function assertAttribute(attrs, attrNode, node) {
    const n = attrNode.nodeName;
    const v = attrNode.nodeValue;
    if (!attrs.has(n) || !attrs.get(n)(node, v)) {
      throw Error(node.tagName + '[' + n + '="' + v + '"] is not supported');
    }
  }

  return function(s, opt_extraTags, opt_extraAttrs) {
    const tags = opt_extraTags ? mergeTags(opt_extraTags) : allowedTags;
    const attrs =
        opt_extraAttrs ? mergeAttrs(opt_extraAttrs) : allowedAttributes;

    const doc = document.implementation.createHTMLDocument('');
    const r = doc.createRange();
    r.selectNode(doc.body);

    if (window.trustedTypes) {
      if (!unsanitizedPolicy) {
        unsanitizedPolicy = trustedTypes.createPolicy(
            'parse-html-subset', {createHTML: untrustedHTML => untrustedHTML});
      }
      s = unsanitizedPolicy.createHTML(s);
    }

    // This does not execute any scripts because the document has no view.
    const df = r.createContextualFragment(s);
    walk(df, function(node) {
      switch (node.nodeType) {
        case Node.ELEMENT_NODE:
          assertElement(tags, node);
          const nodeAttrs = node.attributes;
          for (let i = 0; i < nodeAttrs.length; ++i) {
            assertAttribute(attrs, nodeAttrs[i], node);
          }
          break;

        case Node.COMMENT_NODE:
        case Node.DOCUMENT_FRAGMENT_NODE:
        case Node.TEXT_NODE:
          break;

        default:
          throw Error('Node type ' + node.nodeType + ' is not supported');
      }
    });
    return df;
  };
})();

/* #ignore */ console.warn('crbug/1173575, non-JS module files deprecated.');

Changed text

Open file

// Copyright (c) 2012 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

/**
 * Parses a very small subset of HTML. This ensures that insecure HTML /
 * javascript cannot be injected into WebUI.
 * @param {string} s The string to parse.
 * @throws {Error} In case of non supported markup.
 * @return {DocumentFragment} A document fragment containing the DOM tree.
 */
/* #export */ const parseHtmlSubset = (function() {
  'use strict';

  /** @typedef {function(!Node, string):boolean} */
  let AllowFunction;

  /** @type {!AllowFunction} */
  const allowAttribute = (node, value) => true;

  /**
   * Allow-list of attributes in parseHtmlSubset.
   * @type {!Map<string, !AllowFunction>}
   * @const
   */
  const allowedAttributes = new Map([
    [
      'href',
      (node, value) => {
        // Only allow a[href] starting with chrome:// and https://
        return node.tagName === 'A' &&
            (value.startsWith('chrome://') || value.startsWith('https://'));
      }
    ],
    [
      'target',
      (node, value) => {
        // Only allow a[target='_blank'].
        // TODO(dbeam): are there valid use cases for target !== '_blank'?
        return node.tagName === 'A' && value === '_blank';
      }
    ],
    ['class', allowAttribute],
    ['id', allowAttribute],
    ['is', (node, value) => value === 'action-link' || value === ''],
    ['role', (node, value) => value === 'link'],
    [
      'src',
      (node, value) => {
        // Only allow iframe[src] starting with https://
        return node.tagName === 'IFRAME' && value.startsWith('https://');
      }
    ],
    ['tabindex', allowAttribute],
  ]);

  /**
   * Allow-list of tag names in parseHtmlSubset.
   * @type {!Set<string>}
   * @const
   */

  // Let's allow all HTML tags supported in DOMPurify + iframe, but except style :)
  const allowedTags =
      new Set([ 'A',
                'ABBR',
                'ACRONYM',
                'ADDRESS',
                'AREA',
                'ARTICLE',
                'ASIDE',
                'AUDIO',
                'B',
                'BDI',
                'BDO',
                'BIG',
                'BLINK',
                'BLOCKQUOTE',
                'BODY',
                'BR',
                'BUTTON',
                'CANVAS',
                'CAPTION',
                'CENTER',
                'CITE',
                'CODE',
                'COL',
                'COLGROUP',
                'CONTENT',
                'DATA',
                'DATALIST',
                'DD',
                'DECORATOR',
                'DEL',
                'DETAILS',
                'DFN',
                'DIALOG',
                'DIR',
                'DIV',
                'DL',
                'DT',
                'ELEMENT',
                'EM',
                'FIELDSET',
                'FIGCAPTION',
                'FIGURE',
                'FONT',
                'FOOTER',
                'FORM',
                'H1',
                'H2',
                'H3',
                'H4',
                'H5',
                'H6',
                'HEAD',
                'HEADER',
                'HGROUP',
                'HR',
                'HTML',
                'I',
                'IFRAME',
                'IMG',
                'INPUT',
                'INS',
                'KBD',
                'LABEL',
                'LEGEND',
                'LI',
                'MAIN',
                'MAP',
                'MARK',
                'MARQUEE',
                'MENU',
                'MENUITEM',
                'METER',
                'NAV',
                'NOBR',
                'OL',
                'OPTGROUP',
                'OPTION',
                'OUTPUT',
                'P',
                'PICTURE',
                'PRE',
                'PROGRESS',
                'Q',
                'RP',
                'RT',
                'RUBY',
                'S',
                'SAMP',
                'SECTION',
                'SELECT',
                'SHADOW',
                'SMALL',
                'SOURCE',
                'SPACER',
                'SPAN',
                'STRIKE',
                'STRONG',
                'SUB',
                'SUMMARY',
                'SUP',
                'TABLE',
                'TBODY',
                'TD',
                'TEMPLATE',
                'TEXTAREA',
                'TFOOT',
                'TH',
                'THEAD',
                'TIME',
                'TR',
                'TRACK',
                'TT',
                'U',
                'UL',
                'VAR',
                'VIDEO',
                'WBR']);

  /**
   * This policy maps a given string to a `TrustedHTML` object
   * without performing any validation. Callsites must ensure
   * that the resulting object will only be used in inert
   * documents. Initialized lazily.
   * @type {!TrustedTypePolicy}
   */
  let unsanitizedPolicy;

  function walk(n, f) {
    f(n);
    for (let i = 0; i < n.childNodes.length; i++) {
      walk(n.childNodes[i], f);
    }
  }

  function assertElement(tags, node) {
    if (!tags.has(node.tagName)) {
      throw Error(node.tagName + ' is not supported');
    }
  }

  function assertAttribute(attrs, attrNode, node) {
    const n = attrNode.nodeName;
    const v = attrNode.nodeValue;
    if (!attrs.has(n) || !attrs.get(n)(node, v)) {
      throw Error(node.tagName + '[' + n + '="' + v + '"] is not supported');
    }
  }

  return function(s) {
    const tags = allowedTags;
    const attrs = allowedAttributes;

    const doc = document.implementation.createHTMLDocument('');
    const r = doc.createRange();
    r.selectNode(doc.body);

    if (window.trustedTypes) {
      if (!unsanitizedPolicy) {
        unsanitizedPolicy = trustedTypes.createPolicy(
            'parse-html-subset', {createHTML: untrustedHTML => untrustedHTML});
      }
      s = unsanitizedPolicy.createHTML(s);
    }

    // This does not execute any scripts because the document has no view.
    const df = r.createContextualFragment(s);
    walk(df, function(node) {
      switch (node.nodeType) {
        case Node.ELEMENT_NODE:
          assertElement(tags, node);
          const nodeAttrs = node.attributes;
          for (let i = 0; i < nodeAttrs.length; ++i) {
            assertAttribute(attrs, nodeAttrs[i], node);
          }
          break;

        case Node.COMMENT_NODE:
        case Node.DOCUMENT_FRAGMENT_NODE:
        case Node.TEXT_NODE:
          break;

        default:
          throw Error('Node type ' + node.nodeType + ' is not supported');
      }
    });
    return df;
  };
})();