Compare text

Find the difference between two text files

Real-time editor

Hide unchanged lines

Disable line wrap

Layout

Diff precision

Syntax highlighting

Diffchecker Desktop The most secure way to run Diffchecker. Get the Diffchecker Desktop app: your diffs never leave your computer!Get Desktop

parse_html_subset.diff

Created 5 years agoDiff never expires

58 removals

Lines
Total
Removed

Characters
Total
Removed

To continue using this feature, upgrade to Diffchecker Pro View Pricing

185 lines

123 additions

Lines
Total
Added

Characters
Total
Added

To continue using this feature, upgrade to Diffchecker Pro View Pricing

253 lines

// Use of this source code is governed by a BSD-style license that can be

// found in the LICENSE file.

/**

* Parses a very small subset of HTML. This ensures that insecure HTML /

* javascript cannot be injected into WebUI.

* @param {string} s The string to parse.

* @param {!Array<string>=} opt_extraTags Optional extra allowed tags.

* @param {!Array<string>=} opt_extraAttrs

* Optional extra allowed attributes (all tags are run through these).

* @throws {Error} In case of non supported markup.

* @return {DocumentFragment} A document fragment containing the DOM tree.

/* #export */ const parseHtmlSubset = (function() {

'use strict';

/** @typedef {function(!Node, string):boolean} */

let AllowFunction;

/** @type {!AllowFunction} */

const allowAttribute = (node, value) => true;

/**

* Allow-list of attributes in parseHtmlSubset.

* @type {!Map<string, !AllowFunction>}

* @const

const allowedAttributes = new Map([

[

'href',

(node, value) => {

// Only allow a[href] starting with chrome:// and https://

return node.tagName === 'A' &&

(value.startsWith('chrome://') || value.startsWith('https://'));

}

[

'target',

(node, value) => {

// Only allow a[target='_blank'].

// TODO(dbeam): are there valid use cases for target !== '_blank'?

return node.tagName === 'A' && value === '_blank';

}

]);

/**

* Allow-list of optional attributes in parseHtmlSubset.

* @type {!Map<string, !AllowFunction>}

* @const

const allowedOptionalAttributes = new Map([

['class', allowAttribute],

['id', allowAttribute],

['is', (node, value) => value === 'action-link' || value === ''],

['role', (node, value) => value === 'link'],

[

'src',

(node, value) => {

// Only allow img[src] starting with chrome://

// Only allow iframe[src] starting with https://

return node.tagName === 'IMG' && value.startsWith('chrome://');

return node.tagName === 'IFRAME' && value.startsWith('https://');

}

['tabindex', allowAttribute],

]);

/**

* Allow-list of tag names in parseHtmlSubset.

* @type {!Set<string>}

* @const

// Let's allow all HTML tags supported in DOMPurify + iframe, but except style :)

const allowedTags =

new Set(['A', 'B', 'BR', 'DIV', 'P', 'PRE', 'SPAN', 'STRONG']);

new Set([ 'A',

'ABBR',

/**

'ACRONYM',

* Allow-list of optional tag names in parseHtmlSubset.

'ADDRESS',

* @type {!Set<string>}

'AREA',

* @const

'ARTICLE',

'ASIDE',

const allowedOptionalTags = new Set(['IMG']);

'AUDIO',

'B',

'BDI',

'BDO',

'BIG',

'BLINK',

'BLOCKQUOTE',

'BODY',

'BR',

'BUTTON',

'CANVAS',

'CAPTION',

'CENTER',

'CITE',

'CODE',

'COL',

'COLGROUP',

'CONTENT',

'DATA',

'DATALIST',

'DD',

'DECORATOR',

'DEL',

'DETAILS',

'DFN',

'DIALOG',

'DIR',

'DIV',

'DL',

'DT',

'ELEMENT',

'EM',

'FIELDSET',

'FIGCAPTION',

'FIGURE',

'FONT',

'FOOTER',

'FORM',

'H1',

'H2',

'H3',

'H4',

'H5',

'H6',

'HEAD',

'HEADER',

'HGROUP',

'HR',

'HTML',

'I',

'IFRAME',

'IMG',

'INPUT',

'INS',

'KBD',

'LABEL',

'LEGEND',

'LI',

'MAIN',

'MAP',

'MARK',

'MARQUEE',

'MENU',

'MENUITEM',

'METER',

'NAV',

'NOBR',

'OL',

'OPTGROUP',

'OPTION',

'OUTPUT',

'P',

'PICTURE',

'PRE',

'PROGRESS',

'Q',

'RP',

'RT',

'RUBY',

'S',

'SAMP',

'SECTION',

'SELECT',

'SHADOW',

'SMALL',

'SOURCE',

'SPACER',

'SPAN',

'STRIKE',

'STRONG',

'SUB',

'SUMMARY',

'SUP',

'TABLE',

'TBODY',

'TD',

'TEMPLATE',

'TEXTAREA',

'TFOOT',

'TH',

'THEAD',

'TIME',

'TR',

'TRACK',

'TT',

'U',

'UL',

'VAR',

'VIDEO',

'WBR']);

/**

* This policy maps a given string to a `TrustedHTML` object

* without performing any validation. Callsites must ensure

* that the resulting object will only be used in inert

* documents. Initialized lazily.

* @type {!TrustedTypePolicy}

let unsanitizedPolicy;

/**

* @param {!Array<string>} optTags an Array to merge.

* @return {!Set<string>} Set of allowed tags.

function mergeTags(optTags) {

const clone = new Set(allowedTags);

optTags.forEach(str => {

const tag = str.toUpperCase();

if (allowedOptionalTags.has(tag)) {

clone.add(tag);

}

});

return clone;

}

/**

* @param {!Array<string>} optAttrs an Array to merge.

* @return {!Map<string, !AllowFunction>} Map of allowed

* attributes.

function mergeAttrs(optAttrs) {

const clone = new Map([...allowedAttributes]);

optAttrs.forEach(key => {

if (allowedOptionalAttributes.has(key)) {

clone.set(key, allowedOptionalAttributes.get(key));

}

});

return clone;

}

function walk(n, f) {

f(n);

for (let i = 0; i < n.childNodes.length; i++) {

walk(n.childNodes[i], f);

}

function assertElement(tags, node) {

if (!tags.has(node.tagName)) {

throw Error(node.tagName + ' is not supported');

}

function assertAttribute(attrs, attrNode, node) {

const n = attrNode.nodeName;

const v = attrNode.nodeValue;

if (!attrs.has(n) || !attrs.get(n)(node, v)) {

throw Error(node.tagName + '[' + n + '="' + v + '"] is not supported');

}

return function(s, opt_extraTags, opt_extraAttrs) {

return function(s) {

const tags = opt_extraTags ? mergeTags(opt_extraTags) : allowedTags;

const tags = allowedTags;

const attrs =

const attrs = allowedAttributes;

opt_extraAttrs ? mergeAttrs(opt_extraAttrs) : allowedAttributes;

const doc = document.implementation.createHTMLDocument('');

const r = doc.createRange();

r.selectNode(doc.body);

if (window.trustedTypes) {

if (!unsanitizedPolicy) {

unsanitizedPolicy = trustedTypes.createPolicy(

'parse-html-subset', {createHTML: untrustedHTML => untrustedHTML});

}

s = unsanitizedPolicy.createHTML(s);

}

// This does not execute any scripts because the document has no view.

const df = r.createContextualFragment(s);

walk(df, function(node) {

switch (node.nodeType) {

case Node.ELEMENT_NODE:

assertElement(tags, node);

const nodeAttrs = node.attributes;

for (let i = 0; i < nodeAttrs.length; ++i) {

assertAttribute(attrs, nodeAttrs[i], node);

}

break;

case Node.COMMENT_NODE:

case Node.DOCUMENT_FRAGMENT_NODE:

case Node.TEXT_NODE:

break;

default:

throw Error('Node type ' + node.nodeType + ' is not supported');

}

});

return df;

};

})();

/* #ignore */ console.warn('crbug/1173575, non-JS module files deprecated.');

Saved diffs

Original text

Open file

/**
 * Parses a very small subset of HTML. This ensures that insecure HTML /
 * javascript cannot be injected into WebUI.
 * @param {string} s The string to parse.
 * @param {!Array<string>=} opt_extraTags Optional extra allowed tags.
 * @param {!Array<string>=} opt_extraAttrs
 *     Optional extra allowed attributes (all tags are run through these).
 * @throws {Error} In case of non supported markup.
 * @return {DocumentFragment} A document fragment containing the DOM tree.
 */
/* #export */ const parseHtmlSubset = (function() {
  'use strict';

/** @typedef {function(!Node, string):boolean} */
  let AllowFunction;

/** @type {!AllowFunction} */
  const allowAttribute = (node, value) => true;

/**
   * Allow-list of optional attributes in parseHtmlSubset.
   * @type {!Map<string, !AllowFunction>}
   * @const
   */
  const allowedOptionalAttributes = new Map([
    ['class', allowAttribute],
    ['id', allowAttribute],
    ['is', (node, value) => value === 'action-link' || value === ''],
    ['role', (node, value) => value === 'link'],
    [
      'src',
      (node, value) => {
        // Only allow img[src] starting with chrome://
        return node.tagName === 'IMG' && value.startsWith('chrome://');
      }
    ],
    ['tabindex', allowAttribute],
  ]);

/**
   * Allow-list of tag names in parseHtmlSubset.
   * @type {!Set<string>}
   * @const
   */
  const allowedTags =
      new Set(['A', 'B', 'BR', 'DIV', 'P', 'PRE', 'SPAN', 'STRONG']);

/**
   * Allow-list of optional tag names in parseHtmlSubset.
   * @type {!Set<string>}
   * @const
   */
  const allowedOptionalTags = new Set(['IMG']);

/**
   * This policy maps a given string to a `TrustedHTML` object
   * without performing any validation. Callsites must ensure
   * that the resulting object will only be used in inert
   * documents. Initialized lazily.
   * @type {!TrustedTypePolicy}
   */
  let unsanitizedPolicy;

/**
   * @param {!Array<string>} optTags an Array to merge.
   * @return {!Set<string>} Set of allowed tags.
   */
  function mergeTags(optTags) {
    const clone = new Set(allowedTags);
    optTags.forEach(str => {
      const tag = str.toUpperCase();
      if (allowedOptionalTags.has(tag)) {
        clone.add(tag);
      }
    });
    return clone;
  }

/**
   * @param {!Array<string>} optAttrs an Array to merge.
   * @return {!Map<string, !AllowFunction>} Map of allowed
   *     attributes.
   */
  function mergeAttrs(optAttrs) {
    const clone = new Map([...allowedAttributes]);
    optAttrs.forEach(key => {
      if (allowedOptionalAttributes.has(key)) {
        clone.set(key, allowedOptionalAttributes.get(key));
      }
    });
    return clone;
  }

function walk(n, f) {
    f(n);
    for (let i = 0; i < n.childNodes.length; i++) {
      walk(n.childNodes[i], f);
    }
  }

function assertElement(tags, node) {
    if (!tags.has(node.tagName)) {
      throw Error(node.tagName + ' is not supported');
    }
  }

function assertAttribute(attrs, attrNode, node) {
    const n = attrNode.nodeName;
    const v = attrNode.nodeValue;
    if (!attrs.has(n) || !attrs.get(n)(node, v)) {
      throw Error(node.tagName + '[' + n + '="' + v + '"] is not supported');
    }
  }

return function(s, opt_extraTags, opt_extraAttrs) {
    const tags = opt_extraTags ? mergeTags(opt_extraTags) : allowedTags;
    const attrs =
        opt_extraAttrs ? mergeAttrs(opt_extraAttrs) : allowedAttributes;

const doc = document.implementation.createHTMLDocument('');
    const r = doc.createRange();
    r.selectNode(doc.body);

if (window.trustedTypes) {
      if (!unsanitizedPolicy) {
        unsanitizedPolicy = trustedTypes.createPolicy(
            'parse-html-subset', {createHTML: untrustedHTML => untrustedHTML});
      }
      s = unsanitizedPolicy.createHTML(s);
    }

// This does not execute any scripts because the document has no view.
    const df = r.createContextualFragment(s);
    walk(df, function(node) {
      switch (node.nodeType) {
        case Node.ELEMENT_NODE:
          assertElement(tags, node);
          const nodeAttrs = node.attributes;
          for (let i = 0; i < nodeAttrs.length; ++i) {
            assertAttribute(attrs, nodeAttrs[i], node);
          }
          break;

case Node.COMMENT_NODE:
        case Node.DOCUMENT_FRAGMENT_NODE:
        case Node.TEXT_NODE:
          break;

default:
          throw Error('Node type ' + node.nodeType + ' is not supported');
      }
    });
    return df;
  };
})();

/* #ignore */ console.warn('crbug/1173575, non-JS module files deprecated.');

Changed text

Open file

/**
 * Parses a very small subset of HTML. This ensures that insecure HTML /
 * javascript cannot be injected into WebUI.
 * @param {string} s The string to parse.
 * @throws {Error} In case of non supported markup.
 * @return {DocumentFragment} A document fragment containing the DOM tree.
 */
/* #export */ const parseHtmlSubset = (function() {
  'use strict';

/** @typedef {function(!Node, string):boolean} */
  let AllowFunction;

/** @type {!AllowFunction} */
  const allowAttribute = (node, value) => true;

/**
   * Allow-list of attributes in parseHtmlSubset.
   * @type {!Map<string, !AllowFunction>}
   * @const
   */
  const allowedAttributes = new Map([
    [
      'href',
      (node, value) => {
        // Only allow a[href] starting with chrome:// and https://
        return node.tagName === 'A' &&
            (value.startsWith('chrome://') || value.startsWith('https://'));
      }
    ],
    [
      'target',
      (node, value) => {
        // Only allow a[target='_blank'].
        // TODO(dbeam): are there valid use cases for target !== '_blank'?
        return node.tagName === 'A' && value === '_blank';
      }
    ],
    ['class', allowAttribute],
    ['id', allowAttribute],
    ['is', (node, value) => value === 'action-link' || value === ''],
    ['role', (node, value) => value === 'link'],
    [
      'src',
      (node, value) => {
        // Only allow iframe[src] starting with https://
        return node.tagName === 'IFRAME' && value.startsWith('https://');
      }
    ],
    ['tabindex', allowAttribute],
  ]);

/**
   * Allow-list of tag names in parseHtmlSubset.
   * @type {!Set<string>}
   * @const
   */

// Let's allow all HTML tags supported in DOMPurify + iframe, but except style :)
  const allowedTags =
      new Set([ 'A',
                'ABBR',
                'ACRONYM',
                'ADDRESS',
                'AREA',
                'ARTICLE',
                'ASIDE',
                'AUDIO',
                'B',
                'BDI',
                'BDO',
                'BIG',
                'BLINK',
                'BLOCKQUOTE',
                'BODY',
                'BR',
                'BUTTON',
                'CANVAS',
                'CAPTION',
                'CENTER',
                'CITE',
                'CODE',
                'COL',
                'COLGROUP',
                'CONTENT',
                'DATA',
                'DATALIST',
                'DD',
                'DECORATOR',
                'DEL',
                'DETAILS',
                'DFN',
                'DIALOG',
                'DIR',
                'DIV',
                'DL',
                'DT',
                'ELEMENT',
                'EM',
                'FIELDSET',
                'FIGCAPTION',
                'FIGURE',
                'FONT',
                'FOOTER',
                'FORM',
                'H1',
                'H2',
                'H3',
                'H4',
                'H5',
                'H6',
                'HEAD',
                'HEADER',
                'HGROUP',
                'HR',
                'HTML',
                'I',
                'IFRAME',
                'IMG',
                'INPUT',
                'INS',
                'KBD',
                'LABEL',
                'LEGEND',
                'LI',
                'MAIN',
                'MAP',
                'MARK',
                'MARQUEE',
                'MENU',
                'MENUITEM',
                'METER',
                'NAV',
                'NOBR',
                'OL',
                'OPTGROUP',
                'OPTION',
                'OUTPUT',
                'P',
                'PICTURE',
                'PRE',
                'PROGRESS',
                'Q',
                'RP',
                'RT',
                'RUBY',
                'S',
                'SAMP',
                'SECTION',
                'SELECT',
                'SHADOW',
                'SMALL',
                'SOURCE',
                'SPACER',
                'SPAN',
                'STRIKE',
                'STRONG',
                'SUB',
                'SUMMARY',
                'SUP',
                'TABLE',
                'TBODY',
                'TD',
                'TEMPLATE',
                'TEXTAREA',
                'TFOOT',
                'TH',
                'THEAD',
                'TIME',
                'TR',
                'TRACK',
                'TT',
                'U',
                'UL',
                'VAR',
                'VIDEO',
                'WBR']);

function walk(n, f) {
    f(n);
    for (let i = 0; i < n.childNodes.length; i++) {
      walk(n.childNodes[i], f);
    }
  }

function assertElement(tags, node) {
    if (!tags.has(node.tagName)) {
      throw Error(node.tagName + ' is not supported');
    }
  }

return function(s) {
    const tags = allowedTags;
    const attrs = allowedAttributes;

const doc = document.implementation.createHTMLDocument('');
    const r = doc.createRange();
    r.selectNode(doc.body);

case Node.COMMENT_NODE:
        case Node.DOCUMENT_FRAGMENT_NODE:
        case Node.TEXT_NODE:
          break;

default:
          throw Error('Node type ' + node.nodeType + ' is not supported');
      }
    });
    return df;
  };
})();