| // Copyright 2013 The Closure Library Authors. All Rights Reserved. |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS-IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| |
| |
| /** |
| * @fileoverview |
| * HTML tag filtering, and balancing. |
| * A more user-friendly API is exposed via {@code goog.labs.html.sanitizer}. |
| * @visibility {//visibility:private} |
| */ |
| |
| |
| goog.provide('goog.labs.html.scrubber'); |
| |
| goog.require('goog.array'); |
| goog.require('goog.dom.tags'); |
| goog.require('goog.labs.html.attributeRewriterPresubmitWorkaround'); |
| goog.require('goog.string'); |
| |
| |
| /** |
| * Replaces tags not on the white-list with empty text nodes, dropping all |
| * attributes, and drops other non-text nodes such as comments. |
| * |
| * @param {!Object<string, boolean>} tagWhitelist a set of lower-case tag names |
| * following the convention established by {@link goog.object.createSet}. |
| * @param {!Object<string, Object<string, goog.labs.html.AttributeRewriter>>} |
| * attrWhitelist |
| * maps lower-case tag names and the special string {@code "*"} to functions |
| * from decoded attribute values to sanitized values or {@code null} to |
| * indicate that the attribute is not allowed with that value. |
| * |
| * For example, if {@code attrWhitelist['a']['href']} is defined then it |
| * is used to sanitize the value of the link's URL. |
| * |
| * If {@code attrWhitelist['*']['id']} is defined, and |
| * {@code attrWhitelist['div']['id']} is not, then the former is used to |
| * sanitize any {@code id} attribute on a {@code <div>} element. |
| * @param {string} html a string of HTML |
| * @return {string} the input but with potentially dangerous tokens removed. |
| */ |
| goog.labs.html.scrubber.scrub = function(tagWhitelist, attrWhitelist, html) { |
| return goog.labs.html.scrubber.render_( |
| goog.labs.html.scrubber.balance_( |
| goog.labs.html.scrubber.filter_( |
| tagWhitelist, |
| attrWhitelist, |
| goog.labs.html.scrubber.lex_(html)))); |
| }; |
| |
| |
| /** |
| * Balances tags in trusted HTML. |
| * @param {string} html a string of HTML |
| * @return {string} the input but with an end-tag for each non-void start tag |
| * and only for non-void start tags, and with start and end tags nesting |
| * properly. |
| */ |
| goog.labs.html.scrubber.balance = function(html) { |
| return goog.labs.html.scrubber.render_( |
| goog.labs.html.scrubber.balance_( |
| goog.labs.html.scrubber.lex_(html))); |
| }; |
| |
| |
| /** Character code constant for {@code '<'}. @private */ |
| goog.labs.html.scrubber.CC_LT_ = '<'.charCodeAt(0); |
| |
| |
| /** Character code constant for {@code '!'}. @private */ |
| goog.labs.html.scrubber.CC_BANG_ = '!'.charCodeAt(0); |
| |
| |
| /** Character code constant for {@code '/'}. @private */ |
| goog.labs.html.scrubber.CC_SLASH_ = '/'.charCodeAt(0); |
| |
| |
| /** Character code constant for {@code '?'}. @private */ |
| goog.labs.html.scrubber.CC_QMARK_ = '?'.charCodeAt(0); |
| |
| |
| /** |
| * Matches content following a tag name or attribute value, and before the |
| * beginning of the next attribute value. |
| * @private |
| */ |
| goog.labs.html.scrubber.ATTR_VALUE_PRECEDER_ = '[^=>]+'; |
| |
| |
| /** @private */ |
| goog.labs.html.scrubber.UNQUOTED_ATTR_VALUE_ = '(?:[^"\'\\s>][^\\s>]*)'; |
| |
| |
| /** @private */ |
| goog.labs.html.scrubber.DOUBLE_QUOTED_ATTR_VALUE_ = '(?:"[^"]*"?)'; |
| |
| |
| /** @private */ |
| goog.labs.html.scrubber.SINGLE_QUOTED_ATTR_VALUE_ = "(?:'[^']*'?)"; |
| |
| |
| /** |
| * Matches the equals-sign and any attribute value following it, but does not |
| * capture any {@code >} that would close the tag. |
| * @private |
| */ |
| goog.labs.html.scrubber.ATTR_VALUE_ = '=\\s*(?:' + |
| goog.labs.html.scrubber.UNQUOTED_ATTR_VALUE_ + |
| '|' + goog.labs.html.scrubber.DOUBLE_QUOTED_ATTR_VALUE_ + |
| '|' + goog.labs.html.scrubber.SINGLE_QUOTED_ATTR_VALUE_ + ')?'; |
| |
| |
| /** |
| * The body of a tag between the end of the name and the closing {@code >} |
| * if any. |
| * @private |
| */ |
| goog.labs.html.scrubber.ATTRS_ = |
| '(?:' + goog.labs.html.scrubber.ATTR_VALUE_PRECEDER_ + |
| '|' + goog.labs.html.scrubber.ATTR_VALUE_ + ')*'; |
| |
| |
| /** |
| * A character that continues a tag name as defined at |
| * http://www.w3.org/html/wg/drafts/html/master/syntax.html#tag-name-state |
| * @private |
| */ |
| goog.labs.html.scrubber.TAG_NAME_CHAR_ = '[^\t\f\n />]'; |
| |
| |
| /** |
| * Matches when the next character cannot continue a tag name. |
| * @private |
| */ |
| goog.labs.html.scrubber.BREAK_ = |
| '(?!' + goog.labs.html.scrubber.TAG_NAME_CHAR_ + ')'; |
| |
| |
| /** |
| * Matches the open tag and body of a special element : |
| * one whose body cannot contain nested elements so uses special parsing rules. |
| * It does not include the end tag. |
| * @private |
| */ |
| goog.labs.html.scrubber.SPECIAL_ELEMENT_ = '<(?:' + |
| // Special tag name. |
| '(iframe|script|style|textarea|title|xmp)' + |
| // End of tag name |
| goog.labs.html.scrubber.BREAK_ + |
| // Attributes |
| goog.labs.html.scrubber.ATTRS_ + '>' + |
| // Element content includes non '<' characters, and |
| // '<' that don't start a matching end tag. |
| // This uses a back-reference to the tag name to determine whether |
| // the tag names match. |
| // Since matching is case-insensitive, this can only be used in |
| // a case-insensitive regular expression. |
| // JavaScript does not treat Turkish dotted I's as equivalent to their |
| // ASCII equivalents. |
| '(?:[^<]|<(?!/\\1' + goog.labs.html.scrubber.BREAK_ + '))*' + |
| ')'; |
| |
| |
| /** |
| * Regexp pattern for an HTML tag. |
| * @private |
| */ |
| goog.labs.html.scrubber.TAG_ = |
| '<[/]?[a-z]' + goog.labs.html.scrubber.TAG_NAME_CHAR_ + '*' + |
| goog.labs.html.scrubber.ATTRS_ + '>?'; |
| |
| |
| /** |
| * Regexp pattern for an HTML text node. |
| * @private |
| */ |
| goog.labs.html.scrubber.TEXT_NODE_ = '(?:[^<]|<(?![a-z]|[?!/]))+'; |
| |
| |
| /** |
| * Matches HTML comments including HTML 5 "bogus comments" of the form |
| * {@code <!...>} or {@code <?...>} or {@code </...>}. |
| * @private |
| */ |
| goog.labs.html.scrubber.COMMENT_ = |
| '<!--(?:[^\\-]|-+(?![\\->]))*(?:-(?:->?)?)?' + |
| '|<[!?/][^>]*>?'; |
| |
| |
| /** |
| * Regexp pattern for an HTML token after a doctype. |
| * Special elements introduces a capturing group for use with a |
| * back-reference. |
| * @private |
| */ |
| goog.labs.html.scrubber.HTML_TOKENS_RE_ = new RegExp( |
| '(?:' + goog.labs.html.scrubber.TEXT_NODE_ + |
| '|' + goog.labs.html.scrubber.SPECIAL_ELEMENT_ + |
| '|' + goog.labs.html.scrubber.TAG_ + |
| '|' + goog.labs.html.scrubber.COMMENT_ + ')', |
| 'ig'); |
| |
| |
| /** |
| * An HTML tag which captures the name in group 1, |
| * and any attributes in group 2. |
| * @private |
| */ |
| goog.labs.html.scrubber.TAG_RE_ = new RegExp( |
| '<[/]?([a-z]' + goog.labs.html.scrubber.TAG_NAME_CHAR_ + '*)' + |
| '(' + goog.labs.html.scrubber.ATTRS_ + ')>?', |
| 'i'); |
| |
| |
| /** |
| * A global matcher that separates attributes out of the tag body cruft. |
| * @private |
| */ |
| goog.labs.html.scrubber.ATTRS_RE_ = new RegExp( |
| '[^=\\s]+\\s*(?:' + goog.labs.html.scrubber.ATTR_VALUE_ + ')?', 'ig'); |
| |
| |
| /** |
| * Returns an array of HTML tokens including tags, text nodes and comments. |
| * "Special" elements, like {@code <script>..</script>} whose bodies cannot |
| * include nested elements, are returned as single tokens. |
| * |
| * @param {string} html a string of HTML |
| * @return {!Array<string>} |
| * @private |
| */ |
| goog.labs.html.scrubber.lex_ = function(html) { |
| return ('' + html).match(goog.labs.html.scrubber.HTML_TOKENS_RE_) || []; |
| }; |
| |
| |
| /** |
| * Replaces tags not on the white-list with empty text nodes, dropping all |
| * attributes, and drops other non-text nodes such as comments. |
| * |
| * @param {!Object<string, boolean>} tagWhitelist a set of lower-case tag names |
| * following the convention established by {@link goog.object.createSet}. |
| * @param {!Object<string, Object<string, goog.labs.html.AttributeRewriter>> |
| * } attrWhitelist |
| * maps lower-case tag names and the special string {@code "*"} to functions |
| * from decoded attribute values to sanitized values or {@code null} to |
| * indicate that the attribute is not allowed with that value. |
| * |
| * For example, if {@code attrWhitelist['a']['href']} is defined then it is |
| * used to sanitize the value of the link's URL. |
| * |
| * If {@code attrWhitelist['*']['id']} is defined, and |
| * {@code attrWhitelist['div']['id']} is not, then the former is used to |
| * sanitize any {@code id} attribute on a {@code <div>} element. |
| * @param {!Array<string>} htmlTokens an array of HTML tokens as returned by |
| * {@link goog.labs.html.scrubber.lex_}. |
| * @return {!Array<string>} the input array modified in place to have some |
| * tokens removed. |
| * @private |
| */ |
| goog.labs.html.scrubber.filter_ = function( |
| tagWhitelist, attrWhitelist, htmlTokens) { |
| var genericAttrWhitelist = attrWhitelist['*']; |
| for (var i = 0, n = htmlTokens.length; i < n; ++i) { |
| var htmlToken = htmlTokens[i]; |
| if (htmlToken.charCodeAt(0) !== goog.labs.html.scrubber.CC_LT_) { |
| // Definitely not a tag |
| continue; |
| } |
| |
| var tag = htmlToken.match(goog.labs.html.scrubber.TAG_RE_); |
| if (tag) { |
| var lowerCaseTagName = tag[1].toLowerCase(); |
| var isCloseTag = |
| htmlToken.charCodeAt(1) === goog.labs.html.scrubber.CC_SLASH_; |
| var attrs = ''; |
| if (!isCloseTag && tag[2]) { |
| var tagSpecificAttrWhitelist = |
| /** @type {Object<string, goog.labs.html.AttributeRewriter>} */ ( |
| goog.labs.html.scrubber.readOwnProperty_( |
| attrWhitelist, lowerCaseTagName)); |
| if (genericAttrWhitelist || tagSpecificAttrWhitelist) { |
| attrs = goog.labs.html.scrubber.filterAttrs_( |
| tag[2], genericAttrWhitelist, tagSpecificAttrWhitelist); |
| } |
| } |
| var specialContent = htmlToken.substring(tag[0].length); |
| htmlTokens[i] = |
| (tagWhitelist[lowerCaseTagName] === true) ? |
| ( |
| (isCloseTag ? '</' : '<') + lowerCaseTagName + attrs + '>' + |
| specialContent |
| ) : |
| ''; |
| } else if (htmlToken.length > 1) { |
| switch (htmlToken.charCodeAt(1)) { |
| case goog.labs.html.scrubber.CC_BANG_: |
| case goog.labs.html.scrubber.CC_SLASH_: |
| case goog.labs.html.scrubber.CC_QMARK_: |
| htmlTokens[i] = ''; // Elide comments. |
| break; |
| default: |
| // Otherwise, token is just a text node that starts with '<'. |
| // Speed up later passes by normalizing the text node. |
| htmlTokens[i] = htmlTokens[i].replace(/</g, '<'); |
| } |
| } |
| } |
| return htmlTokens; |
| }; |
| |
| |
| /** |
| * Parses attribute names and values out of a tag body and applies the attribute |
| * white-list to produce a tag body containing only safe attributes. |
| * |
| * @param {string} attrsText the text of a tag between the end of the tag name |
| * and the beginning of the tag end marker, so {@code " foo bar='baz'"} for |
| * the tag {@code <tag foo bar='baz'/>}. |
| * @param {Object<string, goog.labs.html.AttributeRewriter>} |
| * genericAttrWhitelist |
| * a whitelist of attribute transformations for attributes that are allowed |
| * on any element. |
| * @param {Object<string, goog.labs.html.AttributeRewriter>} |
| * tagSpecificAttrWhitelist |
| * a whitelist of attribute transformations for attributes that are allowed |
| * on the element started by the tag whose body is {@code tagBody}. |
| * @return {string} a tag-body that consists only of safe attributes. |
| * @private |
| */ |
| goog.labs.html.scrubber.filterAttrs_ = |
| function(attrsText, genericAttrWhitelist, tagSpecificAttrWhitelist) { |
| var attrs = attrsText.match(goog.labs.html.scrubber.ATTRS_RE_); |
| var nAttrs = attrs ? attrs.length : 0; |
| var safeAttrs = ''; |
| for (var i = 0; i < nAttrs; ++i) { |
| var attr = attrs[i]; |
| var eq = attr.indexOf('='); |
| var name, value; |
| if (eq >= 0) { |
| name = goog.string.trim(attr.substr(0, eq)); |
| value = goog.string.stripQuotes( |
| goog.string.trim(attr.substr(eq + 1)), '"\''); |
| } else { |
| name = value = attr; |
| } |
| name = name.toLowerCase(); |
| var rewriter = /** @type {?goog.labs.html.AttributeRewriter} */ ( |
| tagSpecificAttrWhitelist && |
| goog.labs.html.scrubber.readOwnProperty_( |
| tagSpecificAttrWhitelist, name) || |
| genericAttrWhitelist && |
| goog.labs.html.scrubber.readOwnProperty_(genericAttrWhitelist, name)); |
| if (rewriter) { |
| var safeValue = rewriter(goog.string.unescapeEntities(value)); |
| if (safeValue != null) { |
| if (safeValue.implementsGoogStringTypedString) { |
| safeValue = /** @type {goog.string.TypedString} */ |
| (safeValue).getTypedStringValue(); |
| } |
| safeValue = String(safeValue); |
| if (safeValue.indexOf('`') >= 0) { |
| safeValue += ' '; |
| } |
| safeAttrs += |
| ' ' + name + '="' + goog.string.htmlEscape(safeValue, false) + |
| '"'; |
| } |
| } |
| } |
| return safeAttrs; |
| }; |
| |
| |
| /** |
| * @param {!Object} o the object |
| * @param {!string} k a key into o |
| * @return {*} |
| * @private |
| */ |
| goog.labs.html.scrubber.readOwnProperty_ = function(o, k) { |
| return Object.prototype.hasOwnProperty.call(o, k) ? o[k] : undefined; |
| }; |
| |
| |
| /** |
| * We limit the nesting limit of balanced HTML to a large but manageable number |
| * so that built-in browser limits aren't likely to kick in and undo all our |
| * matching of start and end tags. |
| * <br> |
| * This mitigates the HTML parsing equivalent of stack smashing attacks. |
| * <br> |
| * Otherwise, crafted inputs like |
| * {@code <p><p><p><p>...Ad nauseam..</p></p></p></p>} could exploit |
| * browser bugs, and/or undocumented nesting limit recovery code to misnest |
| * tags. |
| * @private |
| * @const |
| */ |
| goog.labs.html.scrubber.BALANCE_NESTING_LIMIT_ = 256; |
| |
| |
| /** |
| * Ensures that there are end-tags for all and only for non-void start tags. |
| * @param {Array<string>} htmlTokens an array of HTML tokens as returned by |
| * {@link goog.labs.html.scrubber.lex}. |
| * @return {!Array<string>} the input array modified in place to have some |
| * tokens removed. |
| * @private |
| */ |
| goog.labs.html.scrubber.balance_ = function(htmlTokens) { |
| var openElementStack = []; |
| for (var i = 0, n = htmlTokens.length; i < n; ++i) { |
| var htmlToken = htmlTokens[i]; |
| if (htmlToken.charCodeAt(0) !== goog.labs.html.scrubber.CC_LT_) { |
| // Definitely not a tag |
| continue; |
| } |
| var tag = htmlToken.match(goog.labs.html.scrubber.TAG_RE_); |
| if (tag) { |
| var lowerCaseTagName = tag[1].toLowerCase(); |
| var isCloseTag = |
| htmlToken.charCodeAt(1) === goog.labs.html.scrubber.CC_SLASH_; |
| // Special case: HTML5 mandates that </br> be treated as <br>. |
| if (isCloseTag && lowerCaseTagName == 'br') { |
| isCloseTag = false; |
| htmlToken = '<br>'; |
| } |
| var isVoidTag = goog.dom.tags.isVoidTag(lowerCaseTagName); |
| if (isVoidTag && isCloseTag) { |
| htmlTokens[i] = ''; |
| continue; |
| } |
| |
| var prefix = ''; |
| |
| // Insert implied open tags. |
| var nOpenElements = openElementStack.length; |
| if (nOpenElements && !isCloseTag) { |
| var top = openElementStack[nOpenElements - 1]; |
| var groups = goog.labs.html.scrubber.ELEMENT_GROUPS_[lowerCaseTagName]; |
| if (groups === undefined) { |
| groups = goog.labs.html.scrubber.Group_.INLINE_; |
| } |
| var canContain = goog.labs.html.scrubber.ELEMENT_CONTENTS_[top]; |
| if (!(groups & canContain)) { |
| var blockContainer = goog.labs.html.scrubber.BLOCK_CONTAINERS_[top]; |
| if ('string' === typeof blockContainer) { |
| var containerCanContain = |
| goog.labs.html.scrubber.ELEMENT_CONTENTS_[blockContainer]; |
| if (containerCanContain & groups) { |
| if (nOpenElements < |
| goog.labs.html.scrubber.BALANCE_NESTING_LIMIT_) { |
| prefix = '<' + blockContainer + '>'; |
| } |
| openElementStack[nOpenElements] = blockContainer; |
| ++nOpenElements; |
| } |
| } |
| } |
| } |
| |
| // Insert any missing close tags we need. |
| var newStackLen = goog.labs.html.scrubber.pickElementsToClose_( |
| lowerCaseTagName, isCloseTag, openElementStack); |
| |
| var nClosed = nOpenElements - newStackLen; |
| if (nClosed) { // ["p", "a", "b"] -> "</b></a></p>" |
| // First, dump anything past the nesting limit. |
| if (nOpenElements > goog.labs.html.scrubber.BALANCE_NESTING_LIMIT_) { |
| nClosed -= nOpenElements - |
| goog.labs.html.scrubber.BALANCE_NESTING_LIMIT_; |
| nOpenElements = goog.labs.html.scrubber.BALANCE_NESTING_LIMIT_; |
| } |
| // Truncate to the new limit, and produce end tags. |
| var closeTags = openElementStack.splice(newStackLen, nClosed); |
| if (closeTags.length) { |
| closeTags.reverse(); |
| prefix += '</' + closeTags.join('></') + '>'; |
| } |
| } |
| |
| // We could do resumption here to handle misnested tags like |
| // <b><i class="c">Foo</b>Bar</i> |
| // which is equivalent to |
| // <b><i class="c">Foo</i></b><i class="c">Bar</i> |
| // but that requires storing attributes on the open element stack |
| // which complicates all the code using it for marginal added value. |
| |
| if (isCloseTag) { |
| // If the close tag matched an open tag, then the closed section |
| // included that tag name. |
| htmlTokens[i] = prefix; |
| } else { |
| if (!isVoidTag) { |
| openElementStack[openElementStack.length] = lowerCaseTagName; |
| } |
| if (openElementStack.length > |
| goog.labs.html.scrubber.BALANCE_NESTING_LIMIT_) { |
| htmlToken = ''; |
| } |
| htmlTokens[i] = prefix + htmlToken; |
| } |
| } |
| } |
| if (openElementStack.length) { |
| if (openElementStack.length > |
| goog.labs.html.scrubber.BALANCE_NESTING_LIMIT_) { |
| openElementStack.length = goog.labs.html.scrubber.BALANCE_NESTING_LIMIT_; |
| } |
| if (openElementStack.length) { |
| openElementStack.reverse(); |
| htmlTokens[htmlTokens.length] = '</' + openElementStack.join('></') + '>'; |
| } |
| } |
| return htmlTokens; |
| }; |
| |
| |
| /** |
| * Normalizes HTML tokens and concatenates them into a string. |
| * @param {Array<string>} htmlTokens an array of HTML tokens as returned by |
| * {@link goog.labs.html.scrubber.lex}. |
| * @return {string} a string of HTML. |
| * @private |
| */ |
| goog.labs.html.scrubber.render_ = function(htmlTokens) { |
| for (var i = 0, n = htmlTokens.length; i < n; ++i) { |
| var htmlToken = htmlTokens[i]; |
| if (htmlToken.charCodeAt(0) === goog.labs.html.scrubber.CC_LT_ && |
| goog.labs.html.scrubber.TAG_RE_.test(htmlToken)) { |
| // The well-formedness and quotedness of attributes must be ensured by |
| // earlier passes. filter does this. |
| } else { |
| if (htmlToken.indexOf('<') >= 0) { |
| htmlToken = htmlToken.replace(/</g, '<'); |
| } |
| if (htmlToken.indexOf('>') >= 0) { |
| htmlToken = htmlToken.replace(/>/g, '>'); |
| } |
| htmlTokens[i] = htmlToken; |
| } |
| } |
| return htmlTokens.join(''); |
| }; |
| |
| |
| /** |
| * Groups of elements used to specify containment relationships. |
| * @enum {number} |
| * @private |
| */ |
| goog.labs.html.scrubber.Group_ = { |
| BLOCK_: (1 << 0), |
| INLINE_: (1 << 1), |
| INLINE_MINUS_A_: (1 << 2), |
| MIXED_: (1 << 3), |
| TABLE_CONTENT_: (1 << 4), |
| HEAD_CONTENT_: (1 << 5), |
| TOP_CONTENT_: (1 << 6), |
| AREA_ELEMENT_: (1 << 7), |
| FORM_ELEMENT_: (1 << 8), |
| LEGEND_ELEMENT_: (1 << 9), |
| LI_ELEMENT_: (1 << 10), |
| DL_PART_: (1 << 11), |
| P_ELEMENT_: (1 << 12), |
| OPTIONS_ELEMENT_: (1 << 13), |
| OPTION_ELEMENT_: (1 << 14), |
| PARAM_ELEMENT_: (1 << 15), |
| TABLE_ELEMENT_: (1 << 16), |
| TR_ELEMENT_: (1 << 17), |
| TD_ELEMENT_: (1 << 18), |
| COL_ELEMENT_: (1 << 19), |
| CHARACTER_DATA_: (1 << 20) |
| }; |
| |
| |
| /** |
| * Element scopes limit where close tags can have effects. |
| * For example, a table cannot be implicitly closed by a {@code </p>} even if |
| * the table appears inside a {@code <p>} because the {@code <table>} element |
| * introduces a scope. |
| * |
| * @enum {number} |
| * @private |
| */ |
| goog.labs.html.scrubber.Scope_ = { |
| COMMON_: (1 << 0), |
| BUTTON_: (1 << 1), |
| LIST_ITEM_: (1 << 2), |
| TABLE_: (1 << 3) |
| }; |
| |
| |
| /** @const @private */ |
| goog.labs.html.scrubber.ALL_SCOPES_ = |
| goog.labs.html.scrubber.Scope_.COMMON_ | |
| goog.labs.html.scrubber.Scope_.BUTTON_ | |
| goog.labs.html.scrubber.Scope_.LIST_ITEM_ | |
| goog.labs.html.scrubber.Scope_.TABLE_; |
| |
| |
| /** |
| * Picks which open HTML elements to close. |
| * |
| * @param {string} lowerCaseTagName The name of the tag. |
| * @param {boolean} isCloseTag True for a {@code </tagname>} tag. |
| * @param {Array<string>} openElementStack The names of elements that have been |
| * opened and not subsequently closed. |
| * @return {number} the length of openElementStack after closing any tags that |
| * need to be closed. |
| * @private |
| */ |
| goog.labs.html.scrubber.pickElementsToClose_ = |
| function(lowerCaseTagName, isCloseTag, openElementStack) { |
| var nOpenElements = openElementStack.length; |
| if (isCloseTag) { |
| // Look for a matching close tag inside blocking scopes. |
| var topMost; |
| if (/^h[1-6]$/.test(lowerCaseTagName)) { |
| // </h1> will close any header. |
| topMost = -1; |
| for (var i = nOpenElements; --i >= 0;) { |
| if (/^h[1-6]$/.test(openElementStack[i])) { |
| topMost = i; |
| } |
| } |
| } else { |
| topMost = goog.array.lastIndexOf(openElementStack, lowerCaseTagName); |
| } |
| if (topMost >= 0) { |
| var blockers = goog.labs.html.scrubber.ALL_SCOPES_ & |
| ~(goog.labs.html.scrubber.ELEMENT_SCOPES_[lowerCaseTagName] | 0); |
| for (var i = nOpenElements; --i > topMost;) { |
| var blocks = |
| goog.labs.html.scrubber.ELEMENT_SCOPES_[openElementStack[i]] | 0; |
| if (blockers & blocks) { |
| return nOpenElements; |
| } |
| } |
| return topMost; |
| } |
| return nOpenElements; |
| } else { |
| // Close anything that cannot contain the tag name. |
| var groups = goog.labs.html.scrubber.ELEMENT_GROUPS_[lowerCaseTagName]; |
| if (groups === undefined) { |
| groups = goog.labs.html.scrubber.Group_.INLINE_; |
| } |
| for (var i = nOpenElements; --i >= 0;) { |
| var canContain = |
| goog.labs.html.scrubber.ELEMENT_CONTENTS_[openElementStack[i]]; |
| if (canContain === undefined) { |
| canContain = goog.labs.html.scrubber.Group_.INLINE_; |
| } |
| if (groups & canContain) { |
| return i + 1; |
| } |
| } |
| return 0; |
| } |
| }; |
| |
| |
| /** |
| * The groups into which the element falls. |
| * The default is an inline element. |
| * @private |
| */ |
| goog.labs.html.scrubber.ELEMENT_GROUPS_ = { |
| 'a': goog.labs.html.scrubber.Group_.INLINE_, |
| 'abbr': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'acronym': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'address': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'applet': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'area': goog.labs.html.scrubber.Group_.AREA_ELEMENT_, |
| 'audio': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'b': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'base': goog.labs.html.scrubber.Group_.HEAD_CONTENT_, |
| 'basefont': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'bdi': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'bdo': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'big': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'blink': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'blockquote': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'body': goog.labs.html.scrubber.Group_.TOP_CONTENT_, |
| 'br': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'button': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'canvas': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'caption': goog.labs.html.scrubber.Group_.TABLE_CONTENT_, |
| 'center': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'cite': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'code': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'col': goog.labs.html.scrubber.Group_.TABLE_CONTENT_ | |
| goog.labs.html.scrubber.Group_.COL_ELEMENT_, |
| 'colgroup': goog.labs.html.scrubber.Group_.TABLE_CONTENT_, |
| 'dd': goog.labs.html.scrubber.Group_.DL_PART_, |
| 'del': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.MIXED_, |
| 'dfn': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'dir': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'div': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'dl': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'dt': goog.labs.html.scrubber.Group_.DL_PART_, |
| 'em': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'fieldset': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'font': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'form': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.FORM_ELEMENT_, |
| 'h1': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'h2': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'h3': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'h4': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'h5': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'h6': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'head': goog.labs.html.scrubber.Group_.TOP_CONTENT_, |
| 'hr': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'html': 0, |
| 'i': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'iframe': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'img': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'input': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'ins': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'isindex': goog.labs.html.scrubber.Group_.INLINE_, |
| 'kbd': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'label': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'legend': goog.labs.html.scrubber.Group_.LEGEND_ELEMENT_, |
| 'li': goog.labs.html.scrubber.Group_.LI_ELEMENT_, |
| 'link': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.HEAD_CONTENT_, |
| 'listing': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'map': goog.labs.html.scrubber.Group_.INLINE_, |
| 'meta': goog.labs.html.scrubber.Group_.HEAD_CONTENT_, |
| 'nobr': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'noframes': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.TOP_CONTENT_, |
| 'noscript': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'object': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_ | |
| goog.labs.html.scrubber.Group_.HEAD_CONTENT_, |
| 'ol': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'optgroup': goog.labs.html.scrubber.Group_.OPTIONS_ELEMENT_, |
| 'option': goog.labs.html.scrubber.Group_.OPTIONS_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.OPTION_ELEMENT_, |
| 'p': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.P_ELEMENT_, |
| 'param': goog.labs.html.scrubber.Group_.PARAM_ELEMENT_, |
| 'pre': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'q': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 's': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'samp': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'script': (goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_ | |
| goog.labs.html.scrubber.Group_.MIXED_ | |
| goog.labs.html.scrubber.Group_.TABLE_CONTENT_ | |
| goog.labs.html.scrubber.Group_.HEAD_CONTENT_ | |
| goog.labs.html.scrubber.Group_.TOP_CONTENT_ | |
| goog.labs.html.scrubber.Group_.AREA_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.FORM_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.LEGEND_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.LI_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.DL_PART_ | |
| goog.labs.html.scrubber.Group_.P_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.OPTIONS_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.OPTION_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.PARAM_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.TABLE_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.TR_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.TD_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.COL_ELEMENT_), |
| 'select': goog.labs.html.scrubber.Group_.INLINE_, |
| 'small': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'span': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'strike': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'strong': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'style': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.HEAD_CONTENT_, |
| 'sub': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'sup': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'table': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.TABLE_ELEMENT_, |
| 'tbody': goog.labs.html.scrubber.Group_.TABLE_CONTENT_, |
| 'td': goog.labs.html.scrubber.Group_.TD_ELEMENT_, |
| 'textarea': goog.labs.html.scrubber.Group_.INLINE_, |
| 'tfoot': goog.labs.html.scrubber.Group_.TABLE_CONTENT_, |
| 'th': goog.labs.html.scrubber.Group_.TD_ELEMENT_, |
| 'thead': goog.labs.html.scrubber.Group_.TABLE_CONTENT_, |
| 'title': goog.labs.html.scrubber.Group_.HEAD_CONTENT_, |
| 'tr': goog.labs.html.scrubber.Group_.TABLE_CONTENT_ | |
| goog.labs.html.scrubber.Group_.TR_ELEMENT_, |
| 'tt': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'u': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'ul': goog.labs.html.scrubber.Group_.BLOCK_, |
| 'var': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'video': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'wbr': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'xmp': goog.labs.html.scrubber.Group_.BLOCK_ |
| }; |
| |
| |
| /** |
| * The groups which the element can contain. |
| * Defaults to 0. |
| * @private |
| */ |
| goog.labs.html.scrubber.ELEMENT_CONTENTS_ = { |
| 'a': goog.labs.html.scrubber.Group_.INLINE_MINUS_A_, |
| 'abbr': goog.labs.html.scrubber.Group_.INLINE_, |
| 'acronym': goog.labs.html.scrubber.Group_.INLINE_, |
| 'address': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.P_ELEMENT_, |
| 'applet': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.PARAM_ELEMENT_, |
| 'b': goog.labs.html.scrubber.Group_.INLINE_, |
| 'bdi': goog.labs.html.scrubber.Group_.INLINE_, |
| 'bdo': goog.labs.html.scrubber.Group_.INLINE_, |
| 'big': goog.labs.html.scrubber.Group_.INLINE_, |
| 'blink': goog.labs.html.scrubber.Group_.INLINE_, |
| 'blockquote': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'body': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'button': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'canvas': goog.labs.html.scrubber.Group_.INLINE_, |
| 'caption': goog.labs.html.scrubber.Group_.INLINE_, |
| 'center': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'cite': goog.labs.html.scrubber.Group_.INLINE_, |
| 'code': goog.labs.html.scrubber.Group_.INLINE_, |
| 'colgroup': goog.labs.html.scrubber.Group_.COL_ELEMENT_, |
| 'dd': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'del': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'dfn': goog.labs.html.scrubber.Group_.INLINE_, |
| 'dir': goog.labs.html.scrubber.Group_.LI_ELEMENT_, |
| 'div': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'dl': goog.labs.html.scrubber.Group_.DL_PART_, |
| 'dt': goog.labs.html.scrubber.Group_.INLINE_, |
| 'em': goog.labs.html.scrubber.Group_.INLINE_, |
| 'fieldset': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.LEGEND_ELEMENT_, |
| 'font': goog.labs.html.scrubber.Group_.INLINE_, |
| 'form': (goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.INLINE_MINUS_A_ | |
| goog.labs.html.scrubber.Group_.TR_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.TD_ELEMENT_), |
| 'h1': goog.labs.html.scrubber.Group_.INLINE_, |
| 'h2': goog.labs.html.scrubber.Group_.INLINE_, |
| 'h3': goog.labs.html.scrubber.Group_.INLINE_, |
| 'h4': goog.labs.html.scrubber.Group_.INLINE_, |
| 'h5': goog.labs.html.scrubber.Group_.INLINE_, |
| 'h6': goog.labs.html.scrubber.Group_.INLINE_, |
| 'head': goog.labs.html.scrubber.Group_.HEAD_CONTENT_, |
| 'html': goog.labs.html.scrubber.Group_.TOP_CONTENT_, |
| 'i': goog.labs.html.scrubber.Group_.INLINE_, |
| 'iframe': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'ins': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'kbd': goog.labs.html.scrubber.Group_.INLINE_, |
| 'label': goog.labs.html.scrubber.Group_.INLINE_, |
| 'legend': goog.labs.html.scrubber.Group_.INLINE_, |
| 'li': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'listing': goog.labs.html.scrubber.Group_.INLINE_, |
| 'map': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.AREA_ELEMENT_, |
| 'nobr': goog.labs.html.scrubber.Group_.INLINE_, |
| 'noframes': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.TOP_CONTENT_, |
| 'noscript': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'object': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.PARAM_ELEMENT_, |
| 'ol': goog.labs.html.scrubber.Group_.LI_ELEMENT_, |
| 'optgroup': goog.labs.html.scrubber.Group_.OPTIONS_ELEMENT_, |
| 'option': goog.labs.html.scrubber.Group_.CHARACTER_DATA_, |
| 'p': goog.labs.html.scrubber.Group_.INLINE_ | |
| goog.labs.html.scrubber.Group_.TABLE_ELEMENT_, |
| 'pre': goog.labs.html.scrubber.Group_.INLINE_, |
| 'q': goog.labs.html.scrubber.Group_.INLINE_, |
| 's': goog.labs.html.scrubber.Group_.INLINE_, |
| 'samp': goog.labs.html.scrubber.Group_.INLINE_, |
| 'script': goog.labs.html.scrubber.Group_.CHARACTER_DATA_, |
| 'select': goog.labs.html.scrubber.Group_.OPTIONS_ELEMENT_, |
| 'small': goog.labs.html.scrubber.Group_.INLINE_, |
| 'span': goog.labs.html.scrubber.Group_.INLINE_, |
| 'strike': goog.labs.html.scrubber.Group_.INLINE_, |
| 'strong': goog.labs.html.scrubber.Group_.INLINE_, |
| 'style': goog.labs.html.scrubber.Group_.CHARACTER_DATA_, |
| 'sub': goog.labs.html.scrubber.Group_.INLINE_, |
| 'sup': goog.labs.html.scrubber.Group_.INLINE_, |
| 'table': goog.labs.html.scrubber.Group_.TABLE_CONTENT_ | |
| goog.labs.html.scrubber.Group_.FORM_ELEMENT_, |
| 'tbody': goog.labs.html.scrubber.Group_.TR_ELEMENT_, |
| 'td': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'textarea': goog.labs.html.scrubber.Group_.CHARACTER_DATA_, |
| 'tfoot': goog.labs.html.scrubber.Group_.FORM_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.TR_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.TD_ELEMENT_, |
| 'th': goog.labs.html.scrubber.Group_.BLOCK_ | |
| goog.labs.html.scrubber.Group_.INLINE_, |
| 'thead': goog.labs.html.scrubber.Group_.FORM_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.TR_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.TD_ELEMENT_, |
| 'title': goog.labs.html.scrubber.Group_.CHARACTER_DATA_, |
| 'tr': goog.labs.html.scrubber.Group_.FORM_ELEMENT_ | |
| goog.labs.html.scrubber.Group_.TD_ELEMENT_, |
| 'tt': goog.labs.html.scrubber.Group_.INLINE_, |
| 'u': goog.labs.html.scrubber.Group_.INLINE_, |
| 'ul': goog.labs.html.scrubber.Group_.LI_ELEMENT_, |
| 'var': goog.labs.html.scrubber.Group_.INLINE_, |
| 'xmp': goog.labs.html.scrubber.Group_.INLINE_ |
| }; |
| |
| |
| /** |
| * The scopes in which an element falls. |
| * No property defaults to 0. |
| * @private |
| */ |
| goog.labs.html.scrubber.ELEMENT_SCOPES_ = { |
| 'applet': goog.labs.html.scrubber.Scope_.COMMON_ | |
| goog.labs.html.scrubber.Scope_.BUTTON_ | |
| goog.labs.html.scrubber.Scope_.LIST_ITEM_, |
| 'button': goog.labs.html.scrubber.Scope_.BUTTON_, |
| 'caption': goog.labs.html.scrubber.Scope_.COMMON_ | |
| goog.labs.html.scrubber.Scope_.BUTTON_ | |
| goog.labs.html.scrubber.Scope_.LIST_ITEM_, |
| 'html': goog.labs.html.scrubber.Scope_.COMMON_ | |
| goog.labs.html.scrubber.Scope_.BUTTON_ | |
| goog.labs.html.scrubber.Scope_.LIST_ITEM_ | |
| goog.labs.html.scrubber.Scope_.TABLE_, |
| 'object': goog.labs.html.scrubber.Scope_.COMMON_ | |
| goog.labs.html.scrubber.Scope_.BUTTON_ | |
| goog.labs.html.scrubber.Scope_.LIST_ITEM_, |
| 'ol': goog.labs.html.scrubber.Scope_.LIST_ITEM_, |
| 'table': goog.labs.html.scrubber.Scope_.COMMON_ | |
| goog.labs.html.scrubber.Scope_.BUTTON_ | |
| goog.labs.html.scrubber.Scope_.LIST_ITEM_ | |
| goog.labs.html.scrubber.Scope_.TABLE_, |
| 'td': goog.labs.html.scrubber.Scope_.COMMON_ | |
| goog.labs.html.scrubber.Scope_.BUTTON_ | |
| goog.labs.html.scrubber.Scope_.LIST_ITEM_, |
| 'th': goog.labs.html.scrubber.Scope_.COMMON_ | |
| goog.labs.html.scrubber.Scope_.BUTTON_ | |
| goog.labs.html.scrubber.Scope_.LIST_ITEM_, |
| 'ul': goog.labs.html.scrubber.Scope_.LIST_ITEM_ |
| }; |
| |
| |
| /** |
| * Per-element, a child that can contain block content. |
| * @private |
| */ |
| goog.labs.html.scrubber.BLOCK_CONTAINERS_ = { |
| 'dl': 'dd', |
| 'ol': 'li', |
| 'table': 'tr', |
| 'tr': 'td', |
| 'ul': 'li' |
| }; |
| |
| |
| goog.labs.html.attributeRewriterPresubmitWorkaround(); |
