cartodb4/cartodb-4.42
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
3628e2f991
cartodb-4.42/lib/assets/javascripts/cdb/vendor/html-css-sanitizer-bundle.js
Your Name 93b7b03c7b first commit
2024-04-06 05:25:13 +00:00

4851 lines
158 KiB
JavaScript
Raw Blame History

// -------------------------------------------------------------------------------------------------------------------
// This file is was created from the google-caja project, and the standalone sanitizer // cd ~/src/cartodb
// https://code.google.com/p/google-caja/wiki/JsHtmlSanitizer
//
// Steps to rebuild this file:
// $ git clone https://github.com/google/caja.git google-caja
// $ cd google-caja
// $ ant
// $ cp ant-lib/com/google/caja/plugin/html-css-sanitizer-bundle.js /path/to/cartodb.js/vendor/
//
// Additional changes after the built file above:
// - Added: This header
// - Modified: `iframe` element. Mark it as unsafe changing code from 4 to 16. (line: 3543)
// - Modified: `sanitizeAttribs` at end, to allow "data-*"" attributes (lines ~4755-4761)
// - changed policy for a::target attribute to be allowed (html4.ATTRIBS: { 'a::target': ... changed value from 10 to 0) (line 3211)
// -------------------------------------------------------------------------------------------------------------------
/* Copyright Google Inc.
* Licensed under the Apache Licence Version 2.0
* Autogenerated at Wed Nov 25 17:35:12 CET 2015
* \@overrides window
* \@provides cssSchema, CSS_PROP_BIT_QUANTITY, CSS_PROP_BIT_HASH_VALUE, CSS_PROP_BIT_NEGATIVE_QUANTITY, CSS_PROP_BIT_QSTRING, CSS_PROP_BIT_URL, CSS_PROP_BIT_UNRESERVED_WORD, CSS_PROP_BIT_UNICODE_RANGE, CSS_PROP_BIT_GLOBAL_NAME, CSS_PROP_BIT_PROPERTY_NAME */
/**
* @const
* @type {number}
*/
var CSS_PROP_BIT_QUANTITY = 1;
/**
* @const
* @type {number}
*/
var CSS_PROP_BIT_HASH_VALUE = 2;
/**
* @const
* @type {number}
*/
var CSS_PROP_BIT_NEGATIVE_QUANTITY = 4;
/**
* @const
* @type {number}
*/
var CSS_PROP_BIT_QSTRING = 8;
/**
* @const
* @type {number}
*/
var CSS_PROP_BIT_URL = 16;
/**
* @const
* @type {number}
*/
var CSS_PROP_BIT_UNRESERVED_WORD = 64;
/**
* @const
* @type {number}
*/
var CSS_PROP_BIT_UNICODE_RANGE = 128;
/**
* @const
* @type {number}
*/
var CSS_PROP_BIT_GLOBAL_NAME = 512;
/**
* @const
* @type {number}
*/
var CSS_PROP_BIT_PROPERTY_NAME = 1024;
var cssSchema = (function () {
var L = [ [ 'aliceblue', 'antiquewhite', 'aqua', 'aquamarine', 'azure',
'beige', 'bisque', 'black', 'blanchedalmond', 'blue', 'blueviolet',
'brown', 'burlywood', 'cadetblue', 'chartreuse', 'chocolate', 'coral',
'cornflowerblue', 'cornsilk', 'crimson', 'cyan', 'darkblue',
'darkcyan', 'darkgoldenrod', 'darkgray', 'darkgreen', 'darkkhaki',
'darkmagenta', 'darkolivegreen', 'darkorange', 'darkorchid', 'darkred',
'darksalmon', 'darkseagreen', 'darkslateblue', 'darkslategray',
'darkturquoise', 'darkviolet', 'deeppink', 'deepskyblue', 'dimgray',
'dodgerblue', 'firebrick', 'floralwhite', 'forestgreen', 'fuchsia',
'gainsboro', 'ghostwhite', 'gold', 'goldenrod', 'gray', 'green',
'greenyellow', 'honeydew', 'hotpink', 'indianred', 'indigo', 'ivory',
'khaki', 'lavender', 'lavenderblush', 'lawngreen', 'lemonchiffon',
'lightblue', 'lightcoral', 'lightcyan', 'lightgoldenrodyellow',
'lightgreen', 'lightgrey', 'lightpink', 'lightsalmon', 'lightseagreen',
'lightskyblue', 'lightslategray', 'lightsteelblue', 'lightyellow',
'lime', 'limegreen', 'linen', 'magenta', 'maroon', 'mediumaquamarine',
'mediumblue', 'mediumorchid', 'mediumpurple', 'mediumseagreen',
'mediumslateblue', 'mediumspringgreen', 'mediumturquoise',
'mediumvioletred', 'midnightblue', 'mintcream', 'mistyrose',
'moccasin', 'navajowhite', 'navy', 'oldlace', 'olive', 'olivedrab',
'orange', 'orangered', 'orchid', 'palegoldenrod', 'palegreen',
'paleturquoise', 'palevioletred', 'papayawhip', 'peachpuff', 'peru',
'pink', 'plum', 'powderblue', 'purple', 'red', 'rosybrown',
'royalblue', 'saddlebrown', 'salmon', 'sandybrown', 'seagreen',
'seashell', 'sienna', 'silver', 'skyblue', 'slateblue', 'slategray',
'snow', 'springgreen', 'steelblue', 'tan', 'teal', 'thistle', 'tomato',
'transparent', 'turquoise', 'violet', 'wheat', 'white', 'whitesmoke',
'yellow', 'yellowgreen' ], [ 'all-scroll', 'col-resize', 'crosshair',
'default', 'e-resize', 'hand', 'help', 'move', 'n-resize', 'ne-resize',
'no-drop', 'not-allowed', 'nw-resize', 'pointer', 'progress',
'row-resize', 's-resize', 'se-resize', 'sw-resize', 'text',
'vertical-text', 'w-resize', 'wait' ], [ 'armenian', 'decimal',
'decimal-leading-zero', 'disc', 'georgian', 'lower-alpha',
'lower-greek', 'lower-latin', 'lower-roman', 'square', 'upper-alpha',
'upper-latin', 'upper-roman' ], [ '100', '200', '300', '400', '500',
'600', '700', '800', '900', 'bold', 'bolder', 'lighter' ], [
'block-level', 'inline-level', 'table-caption', 'table-cell',
'table-column', 'table-column-group', 'table-footer-group',
'table-header-group', 'table-row', 'table-row-group' ], [ 'condensed',
'expanded', 'extra-condensed', 'extra-expanded', 'narrower',
'semi-condensed', 'semi-expanded', 'ultra-condensed', 'ultra-expanded',
'wider' ], [ 'inherit', 'inline', 'inline-block', 'inline-box',
'inline-flex', 'inline-grid', 'inline-list-item', 'inline-stack',
'inline-table', 'run-in' ], [ 'behind', 'center-left', 'center-right',
'far-left', 'far-right', 'left-side', 'leftwards', 'right-side',
'rightwards' ], [ 'large', 'larger', 'small', 'smaller', 'x-large',
'x-small', 'xx-large', 'xx-small' ], [ 'dashed', 'dotted', 'double',
'groove', 'outset', 'ridge', 'solid' ], [ 'ease', 'ease-in',
'ease-in-out', 'ease-out', 'linear', 'step-end', 'step-start' ], [
'at', 'closest-corner', 'closest-side', 'ellipse', 'farthest-corner',
'farthest-side' ], [ 'baseline', 'middle', 'sub', 'super',
'text-bottom', 'text-top' ], [ 'caption', 'icon', 'menu',
'message-box', 'small-caption', 'status-bar' ], [ 'fast', 'faster',
'slow', 'slower', 'x-fast', 'x-slow' ], [ 'above', 'below', 'higher',
'level', 'lower' ], [ 'cursive', 'fantasy', 'monospace', 'sans-serif',
'serif' ], [ 'loud', 'silent', 'soft', 'x-loud', 'x-soft' ], [
'no-repeat', 'repeat-x', 'repeat-y', 'round', 'space' ], [ 'blink',
'line-through', 'overline', 'underline' ], [ 'block', 'flex', 'grid',
'table' ], [ 'high', 'low', 'x-high', 'x-low' ], [ 'nowrap', 'pre',
'pre-line', 'pre-wrap' ], [ 'absolute', 'relative', 'static' ], [
'alternate', 'alternate-reverse', 'reverse' ], [ 'border-box',
'content-box', 'padding-box' ], [ 'capitalize', 'lowercase',
'uppercase' ], [ 'child', 'female', 'male' ], [ '=', 'opacity' ], [
'backwards', 'forwards' ], [ 'bidi-override', 'embed' ], [ 'bottom',
'top' ], [ 'break-all', 'keep-all' ], [ 'clip', 'ellipsis' ], [
'contain', 'cover' ], [ 'continuous', 'digits' ], [ 'end', 'start' ], [
'flat', 'preserve-3d' ], [ 'hide', 'show' ], [ 'horizontal', 'vertical'
], [ 'inside', 'outside' ], [ 'italic', 'oblique' ], [ 'left', 'right' ],
[ 'ltr', 'rtl' ], [ 'no-content', 'no-display' ], [ 'paused', 'running' ]
, [ 'suppress', 'unrestricted' ], [ 'thick', 'thin' ], [ ',' ], [ '/' ],
[ 'all' ], [ 'always' ], [ 'auto' ], [ 'avoid' ], [ 'both' ], [
'break-word' ], [ 'center' ], [ 'circle' ], [ 'code' ], [ 'collapse' ],
[ 'contents' ], [ 'fixed' ], [ 'hidden' ], [ 'infinite' ], [ 'inset' ], [
'invert' ], [ 'justify' ], [ 'list-item' ], [ 'local' ], [ 'medium' ],
[ 'mix' ], [ 'none' ], [ 'normal' ], [ 'once' ], [ 'repeat' ], [ 'scroll'
], [ 'separate' ], [ 'small-caps' ], [ 'spell-out' ], [ 'to' ], [
'visible' ] ];
var schema = {
'animation': {
'cssPropBits': 517,
'cssLitGroup': [ L[ 10 ], L[ 24 ], L[ 29 ], L[ 45 ], L[ 48 ], L[ 54 ],
L[ 63 ], L[ 71 ], L[ 72 ] ],
'cssFns': [ 'cubic-bezier()', 'steps()' ]
},
'animation-delay': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 48 ] ],
'cssFns': [ ]
},
'animation-direction': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 24 ], L[ 48 ], L[ 72 ] ],
'cssFns': [ ]
},
'animation-duration': 'animation-delay',
'animation-fill-mode': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 29 ], L[ 48 ], L[ 54 ], L[ 71 ] ],
'cssFns': [ ]
},
'animation-iteration-count': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 48 ], L[ 63 ] ],
'cssFns': [ ]
},
'animation-name': {
'cssPropBits': 512,
'cssLitGroup': [ L[ 48 ], L[ 71 ] ],
'cssFns': [ ]
},
'animation-play-state': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 45 ], L[ 48 ] ],
'cssFns': [ ]
},
'animation-timing-function': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 10 ], L[ 48 ] ],
'cssFns': [ 'cubic-bezier()', 'steps()' ]
},
'appearance': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 71 ] ],
'cssFns': [ ]
},
'azimuth': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 7 ], L[ 42 ], L[ 56 ] ],
'cssFns': [ ]
},
'backface-visibility': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 59 ], L[ 62 ], L[ 80 ] ],
'cssFns': [ ]
},
'background': {
'cssPropBits': 23,
'cssLitGroup': [ L[ 0 ], L[ 18 ], L[ 25 ], L[ 31 ], L[ 34 ], L[ 42 ],
L[ 48 ], L[ 49 ], L[ 52 ], L[ 56 ], L[ 61 ], L[ 68 ], L[ 71 ], L[ 74
], L[ 75 ] ],
'cssFns': [ 'image()', 'linear-gradient()', 'radial-gradient()',
'repeating-linear-gradient()', 'repeating-radial-gradient()',
'rgb()', 'rgba()' ]
},
'background-attachment': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 48 ], L[ 61 ], L[ 68 ], L[ 75 ] ],
'cssFns': [ ]
},
'background-color': {
'cssPropBits': 2,
'cssLitGroup': [ L[ 0 ] ],
'cssFns': [ 'rgb()', 'rgba()' ]
},
'background-image': {
'cssPropBits': 16,
'cssLitGroup': [ L[ 48 ], L[ 71 ] ],
'cssFns': [ 'image()', 'linear-gradient()', 'radial-gradient()',
'repeating-linear-gradient()', 'repeating-radial-gradient()' ]
},
'background-position': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 31 ], L[ 42 ], L[ 48 ], L[ 56 ] ],
'cssFns': [ ]
},
'background-repeat': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 18 ], L[ 48 ], L[ 74 ] ],
'cssFns': [ ]
},
'background-size': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 34 ], L[ 48 ], L[ 52 ] ],
'cssFns': [ ]
},
'border': {
'cssPropBits': 7,
'cssLitGroup': [ L[ 0 ], L[ 9 ], L[ 47 ], L[ 62 ], L[ 64 ], L[ 69 ], L[
71 ] ],
'cssFns': [ 'rgb()', 'rgba()' ]
},
'border-bottom': 'border',
'border-bottom-color': 'background-color',
'border-bottom-left-radius': {
'cssPropBits': 5,
'cssFns': [ ]
},
'border-bottom-right-radius': 'border-bottom-left-radius',
'border-bottom-style': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 9 ], L[ 62 ], L[ 64 ], L[ 71 ] ],
'cssFns': [ ]
},
'border-bottom-width': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 47 ], L[ 69 ] ],
'cssFns': [ ]
},
'border-collapse': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 59 ], L[ 76 ] ],
'cssFns': [ ]
},
'border-color': 'background-color',
'border-left': 'border',
'border-left-color': 'background-color',
'border-left-style': 'border-bottom-style',
'border-left-width': 'border-bottom-width',
'border-radius': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 49 ] ],
'cssFns': [ ]
},
'border-right': 'border',
'border-right-color': 'background-color',
'border-right-style': 'border-bottom-style',
'border-right-width': 'border-bottom-width',
'border-spacing': 'border-bottom-left-radius',
'border-style': 'border-bottom-style',
'border-top': 'border',
'border-top-color': 'background-color',
'border-top-left-radius': 'border-bottom-left-radius',
'border-top-right-radius': 'border-bottom-left-radius',
'border-top-style': 'border-bottom-style',
'border-top-width': 'border-bottom-width',
'border-width': 'border-bottom-width',
'bottom': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 52 ] ],
'cssFns': [ ]
},
'box': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 60 ], L[ 71 ], L[ 72 ] ],
'cssFns': [ ]
},
'box-shadow': {
'cssPropBits': 7,
'cssLitGroup': [ L[ 0 ], L[ 48 ], L[ 64 ], L[ 71 ] ],
'cssFns': [ 'rgb()', 'rgba()' ]
},
'box-sizing': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 25 ] ],
'cssFns': [ ]
},
'caption-side': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 31 ] ],
'cssFns': [ ]
},
'clear': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 42 ], L[ 54 ], L[ 71 ] ],
'cssFns': [ ]
},
'clip': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 52 ] ],
'cssFns': [ 'rect()' ]
},
'color': 'background-color',
'content': {
'cssPropBits': 8,
'cssLitGroup': [ L[ 71 ], L[ 72 ] ],
'cssFns': [ ]
},
'cue': {
'cssPropBits': 16,
'cssLitGroup': [ L[ 71 ] ],
'cssFns': [ ]
},
'cue-after': 'cue',
'cue-before': 'cue',
'cursor': {
'cssPropBits': 16,
'cssLitGroup': [ L[ 1 ], L[ 48 ], L[ 52 ] ],
'cssFns': [ ]
},
'direction': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 43 ] ],
'cssFns': [ ]
},
'display': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 4 ], L[ 6 ], L[ 20 ], L[ 52 ], L[ 67 ], L[ 71 ] ],
'cssFns': [ ]
},
'display-extras': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 67 ], L[ 71 ] ],
'cssFns': [ ]
},
'display-inside': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 20 ], L[ 52 ] ],
'cssFns': [ ]
},
'display-outside': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 4 ], L[ 71 ] ],
'cssFns': [ ]
},
'elevation': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 15 ] ],
'cssFns': [ ]
},
'empty-cells': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 38 ] ],
'cssFns': [ ]
},
'filter': {
'cssPropBits': 0,
'cssFns': [ 'alpha()' ]
},
'float': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 42 ], L[ 71 ] ],
'cssFns': [ ]
},
'font': {
'cssPropBits': 73,
'cssLitGroup': [ L[ 3 ], L[ 8 ], L[ 13 ], L[ 16 ], L[ 41 ], L[ 48 ], L[
49 ], L[ 69 ], L[ 72 ], L[ 77 ] ],
'cssFns': [ ]
},
'font-family': {
'cssPropBits': 72,
'cssLitGroup': [ L[ 16 ], L[ 48 ] ],
'cssFns': [ ]
},
'font-size': {
'cssPropBits': 1,
'cssLitGroup': [ L[ 8 ], L[ 69 ] ],
'cssFns': [ ]
},
'font-stretch': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 5 ], L[ 72 ] ],
'cssFns': [ ]
},
'font-style': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 41 ], L[ 72 ] ],
'cssFns': [ ]
},
'font-variant': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 72 ], L[ 77 ] ],
'cssFns': [ ]
},
'font-weight': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 3 ], L[ 72 ] ],
'cssFns': [ ]
},
'height': 'bottom',
'left': 'bottom',
'letter-spacing': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 72 ] ],
'cssFns': [ ]
},
'line-height': {
'cssPropBits': 1,
'cssLitGroup': [ L[ 72 ] ],
'cssFns': [ ]
},
'list-style': {
'cssPropBits': 16,
'cssLitGroup': [ L[ 2 ], L[ 40 ], L[ 57 ], L[ 71 ] ],
'cssFns': [ 'image()', 'linear-gradient()', 'radial-gradient()',
'repeating-linear-gradient()', 'repeating-radial-gradient()' ]
},
'list-style-image': {
'cssPropBits': 16,
'cssLitGroup': [ L[ 71 ] ],
'cssFns': [ 'image()', 'linear-gradient()', 'radial-gradient()',
'repeating-linear-gradient()', 'repeating-radial-gradient()' ]
},
'list-style-position': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 40 ] ],
'cssFns': [ ]
},
'list-style-type': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 2 ], L[ 57 ], L[ 71 ] ],
'cssFns': [ ]
},
'margin': 'bottom',
'margin-bottom': 'bottom',
'margin-left': 'bottom',
'margin-right': 'bottom',
'margin-top': 'bottom',
'max-height': {
'cssPropBits': 1,
'cssLitGroup': [ L[ 52 ], L[ 71 ] ],
'cssFns': [ ]
},
'max-width': 'max-height',
'min-height': {
'cssPropBits': 1,
'cssLitGroup': [ L[ 52 ] ],
'cssFns': [ ]
},
'min-width': 'min-height',
'opacity': {
'cssPropBits': 1,
'cssFns': [ ]
},
'outline': {
'cssPropBits': 7,
'cssLitGroup': [ L[ 0 ], L[ 9 ], L[ 47 ], L[ 62 ], L[ 64 ], L[ 65 ], L[
69 ], L[ 71 ] ],
'cssFns': [ 'rgb()', 'rgba()' ]
},
'outline-color': {
'cssPropBits': 2,
'cssLitGroup': [ L[ 0 ], L[ 65 ] ],
'cssFns': [ 'rgb()', 'rgba()' ]
},
'outline-style': 'border-bottom-style',
'outline-width': 'border-bottom-width',
'overflow': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 52 ], L[ 62 ], L[ 75 ], L[ 80 ] ],
'cssFns': [ ]
},
'overflow-wrap': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 55 ], L[ 72 ] ],
'cssFns': [ ]
},
'overflow-x': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 44 ], L[ 52 ], L[ 62 ], L[ 75 ], L[ 80 ] ],
'cssFns': [ ]
},
'overflow-y': 'overflow-x',
'padding': 'opacity',
'padding-bottom': 'opacity',
'padding-left': 'opacity',
'padding-right': 'opacity',
'padding-top': 'opacity',
'page-break-after': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 42 ], L[ 51 ], L[ 52 ], L[ 53 ] ],
'cssFns': [ ]
},
'page-break-before': 'page-break-after',
'page-break-inside': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 52 ], L[ 53 ] ],
'cssFns': [ ]
},
'pause': 'border-bottom-left-radius',
'pause-after': 'border-bottom-left-radius',
'pause-before': 'border-bottom-left-radius',
'perspective': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 71 ] ],
'cssFns': [ ]
},
'perspective-origin': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 31 ], L[ 42 ], L[ 56 ] ],
'cssFns': [ ]
},
'pitch': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 21 ], L[ 69 ] ],
'cssFns': [ ]
},
'pitch-range': 'border-bottom-left-radius',
'play-during': {
'cssPropBits': 16,
'cssLitGroup': [ L[ 52 ], L[ 70 ], L[ 71 ], L[ 74 ] ],
'cssFns': [ ]
},
'position': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 23 ] ],
'cssFns': [ ]
},
'quotes': {
'cssPropBits': 8,
'cssLitGroup': [ L[ 71 ] ],
'cssFns': [ ]
},
'resize': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 39 ], L[ 54 ], L[ 71 ] ],
'cssFns': [ ]
},
'richness': 'border-bottom-left-radius',
'right': 'bottom',
'speak': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 71 ], L[ 72 ], L[ 78 ] ],
'cssFns': [ ]
},
'speak-header': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 51 ], L[ 73 ] ],
'cssFns': [ ]
},
'speak-numeral': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 35 ] ],
'cssFns': [ ]
},
'speak-punctuation': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 58 ], L[ 71 ] ],
'cssFns': [ ]
},
'speech-rate': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 14 ], L[ 69 ] ],
'cssFns': [ ]
},
'stress': 'border-bottom-left-radius',
'table-layout': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 52 ], L[ 61 ] ],
'cssFns': [ ]
},
'text-align': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 42 ], L[ 56 ], L[ 66 ] ],
'cssFns': [ ]
},
'text-decoration': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 19 ], L[ 71 ] ],
'cssFns': [ ]
},
'text-indent': 'border-bottom-left-radius',
'text-overflow': {
'cssPropBits': 8,
'cssLitGroup': [ L[ 33 ] ],
'cssFns': [ ]
},
'text-shadow': 'box-shadow',
'text-transform': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 26 ], L[ 71 ] ],
'cssFns': [ ]
},
'text-wrap': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 46 ], L[ 71 ], L[ 72 ] ],
'cssFns': [ ]
},
'top': 'bottom',
'transform': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 71 ] ],
'cssFns': [ 'matrix()', 'perspective()', 'rotate()', 'rotate3d()',
'rotatex()', 'rotatey()', 'rotatez()', 'scale()', 'scale3d()',
'scalex()', 'scaley()', 'scalez()', 'skew()', 'skewx()', 'skewy()',
'translate()', 'translate3d()', 'translatex()', 'translatey()',
'translatez()' ]
},
'transform-origin': 'perspective-origin',
'transform-style': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 37 ] ],
'cssFns': [ ]
},
'transition': {
'cssPropBits': 1029,
'cssLitGroup': [ L[ 10 ], L[ 48 ], L[ 50 ], L[ 71 ] ],
'cssFns': [ 'cubic-bezier()', 'steps()' ]
},
'transition-delay': 'animation-delay',
'transition-duration': 'animation-delay',
'transition-property': {
'cssPropBits': 1024,
'cssLitGroup': [ L[ 48 ], L[ 50 ] ],
'cssFns': [ ]
},
'transition-timing-function': 'animation-timing-function',
'unicode-bidi': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 30 ], L[ 72 ] ],
'cssFns': [ ]
},
'vertical-align': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 12 ], L[ 31 ] ],
'cssFns': [ ]
},
'visibility': 'backface-visibility',
'voice-family': {
'cssPropBits': 8,
'cssLitGroup': [ L[ 27 ], L[ 48 ] ],
'cssFns': [ ]
},
'volume': {
'cssPropBits': 1,
'cssLitGroup': [ L[ 17 ], L[ 69 ] ],
'cssFns': [ ]
},
'white-space': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 22 ], L[ 72 ] ],
'cssFns': [ ]
},
'width': 'min-height',
'word-break': {
'cssPropBits': 0,
'cssLitGroup': [ L[ 32 ], L[ 72 ] ],
'cssFns': [ ]
},
'word-spacing': 'letter-spacing',
'word-wrap': 'overflow-wrap',
'z-index': 'bottom',
'zoom': 'line-height',
'cubic-bezier()': 'animation-delay',
'steps()': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 36 ], L[ 48 ] ],
'cssFns': [ ]
},
'image()': {
'cssPropBits': 18,
'cssLitGroup': [ L[ 0 ], L[ 48 ] ],
'cssFns': [ 'rgb()', 'rgba()' ]
},
'linear-gradient()': {
'cssPropBits': 7,
'cssLitGroup': [ L[ 0 ], L[ 31 ], L[ 42 ], L[ 48 ], L[ 79 ] ],
'cssFns': [ 'rgb()', 'rgba()' ]
},
'radial-gradient()': {
'cssPropBits': 7,
'cssLitGroup': [ L[ 0 ], L[ 11 ], L[ 31 ], L[ 42 ], L[ 48 ], L[ 56 ],
L[ 57 ] ],
'cssFns': [ 'rgb()', 'rgba()' ]
},
'repeating-linear-gradient()': 'linear-gradient()',
'repeating-radial-gradient()': 'radial-gradient()',
'rgb()': {
'cssPropBits': 1,
'cssLitGroup': [ L[ 48 ] ],
'cssFns': [ ]
},
'rgba()': 'rgb()',
'rect()': {
'cssPropBits': 5,
'cssLitGroup': [ L[ 48 ], L[ 52 ] ],
'cssFns': [ ]
},
'alpha()': {
'cssPropBits': 1,
'cssLitGroup': [ L[ 28 ] ],
'cssFns': [ ]
},
'matrix()': 'animation-delay',
'perspective()': 'border-bottom-left-radius',
'rotate()': 'border-bottom-left-radius',
'rotate3d()': 'animation-delay',
'rotatex()': 'border-bottom-left-radius',
'rotatey()': 'border-bottom-left-radius',
'rotatez()': 'border-bottom-left-radius',
'scale()': 'animation-delay',
'scale3d()': 'animation-delay',
'scalex()': 'border-bottom-left-radius',
'scaley()': 'border-bottom-left-radius',
'scalez()': 'border-bottom-left-radius',
'skew()': 'animation-delay',
'skewx()': 'border-bottom-left-radius',
'skewy()': 'border-bottom-left-radius',
'translate()': 'animation-delay',
'translate3d()': 'animation-delay',
'translatex()': 'border-bottom-left-radius',
'translatey()': 'border-bottom-left-radius',
'translatez()': 'border-bottom-left-radius'
};
if (true) {
for (var key in schema) {
if ('string' === typeof schema[ key ] &&
Object.hasOwnProperty.call(schema, key)) {
schema[ key ] = schema[ schema[ key ] ];
}
}
}
return schema;
})();
if (typeof window !== 'undefined') {
window['cssSchema'] = cssSchema;
}
;
// Copyright (C) 2011 Google Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/**
* A lexical scannar for CSS3 as defined at http://www.w3.org/TR/css3-syntax .
*
* @author Mike Samuel <mikesamuel@gmail.com>
* \@provides lexCss, decodeCss
* \@overrides window
*/
var lexCss;
var decodeCss;
(function () {
/**
* Decodes an escape sequence as specified in CSS3 section 4.1.
* http://www.w3.org/TR/css3-syntax/#characters
* @private
*/
function decodeCssEscape(s) {
var i = parseInt(s.substring(1), 16);
// If parseInt didn't find a hex diigt, it returns NaN so return the
// escaped character.
// Otherwise, parseInt will stop at the first non-hex digit so there's no
// need to worry about trailing whitespace.
if (i > 0xffff) {
// A supplemental codepoint.
return i -= 0x10000,
String.fromCharCode(
0xd800 + (i >> 10),
0xdc00 + (i & 0x3FF));
} else if (i == i) {
return String.fromCharCode(i);
} else if (s[1] < ' ') {
// "a backslash followed by a newline is ignored".
return '';
} else {
return s[1];
}
}
/**
* Returns an equivalent CSS string literal given plain text: foo -> "foo".
* @private
*/
function escapeCssString(s, replacer) {
return '"' + s.replace(/[\u0000-\u001f\\\"<>]/g, replacer) + '"';
}
/**
* Maps chars to CSS escaped equivalents: "\n" -> "\\a ".
* @private
*/
function escapeCssStrChar(ch) {
return cssStrChars[ch]
|| (cssStrChars[ch] = '\\' + ch.charCodeAt(0).toString(16) + ' ');
}
/**
* Maps chars to URI escaped equivalents: "\n" -> "%0a".
* @private
*/
function escapeCssUrlChar(ch) {
return cssUrlChars[ch]
|| (cssUrlChars[ch] = (ch < '\x10' ? '%0' : '%')
+ ch.charCodeAt(0).toString(16));
}
/**
* Mapping of CSS special characters to escaped equivalents.
* @private
*/
var cssStrChars = {
'\\': '\\\\'
};
/**
* Mapping of CSS special characters to URL-escaped equivalents.
* @private
*/
var cssUrlChars = {
'\\': '%5c'
};
// The comments below are copied from the CSS3 module syntax at
// http://www.w3.org/TR/css3-syntax .
// These string constants minify out when this is run-through closure
// compiler.
// Rules that have been adapted have comments prefixed with "Diff:", and
// where rules have been combined to avoid back-tracking in the regex engine
// or to work around limitations, there is a comment prefixed with
// "NewRule:".
// In the below, we assume CRLF and CR have been normalize to CR.
// wc ::= #x9 | #xA | #xC | #xD | #x20
var WC = '[\\t\\n\\f ]';
// w ::= wc*
var W = WC + '*';
// nl ::= #xA | #xD #xA | #xD | #xC
var NL = '[\\n\\f]';
// nonascii ::= [#x80-#xD7FF#xE000-#xFFFD#x10000-#x10FFFF]
// NewRule: Supplemental codepoints are represented as surrogate pairs in JS.
var SURROGATE_PAIR = '[\\ud800-\\udbff][\\udc00-\\udfff]';
var NONASCII = '[\\u0080-\\ud7ff\\ue000-\\ufffd]|' + SURROGATE_PAIR;
// unicode ::= '\' [0-9a-fA-F]{1,6} wc?
// NewRule: No point in having ESCAPE do (\\x|\\y)
var UNICODE_TAIL = '[0-9a-fA-F]{1,6}' + WC + '?';
var UNICODE = '\\\\' + UNICODE_TAIL;
// escape ::= unicode
// | '\' [#x20-#x7E#x80-#xD7FF#xE000-#xFFFD#x10000-#x10FFFF]
// NewRule: Below we use escape tail to efficiently match an escape or a
// line continuation so we can decode string content.
var ESCAPE_TAIL = '(?:' + UNICODE_TAIL
+ '|[\\u0020-\\u007e\\u0080-\\ud7ff\\ue000\\ufffd]|'
+ SURROGATE_PAIR + ')';
var ESCAPE = '\\\\' + ESCAPE_TAIL;
// urlchar ::= [#x9#x21#x23-#x26#x28-#x7E] | nonascii | escape
var URLCHAR = '(?:[\\t\\x21\\x23-\\x26\\x28-\\x5b\\x5d-\\x7e]|'
+ NONASCII + '|' + ESCAPE + ')';
// stringchar ::= urlchar | #x20 | '\' nl
// We ignore mismatched surrogate pairs inside strings, so stringchar
// simplifies to a non-(quote|newline|backslash) or backslash any.
// Since we normalize CRLF to a single code-unit, there is no special
// handling needed for '\\' + CRLF.
var STRINGCHAR = '[^\'"\\n\\f\\\\]|\\\\[\\s\\S]';
// string ::= '"' (stringchar | "'")* '"' | "'" (stringchar | '"')* "'"
var STRING = '"(?:\'|' + STRINGCHAR + ')*"'
+ '|\'(?:\"|' + STRINGCHAR + ')*\'';
// num ::= [0-9]+ | [0-9]* '.' [0-9]+
// Diff: We attach signs to num tokens.
var NUM = '[-+]?(?:[0-9]+(?:[.][0-9]+)?|[.][0-9]+)';
// nmstart ::= [a-zA-Z] | '_' | nonascii | escape
var NMSTART = '(?:[a-zA-Z_]|' + NONASCII + '|' + ESCAPE + ')';
// nmchar ::= [a-zA-Z0-9] | '-' | '_' | nonascii | escape
var NMCHAR = '(?:[a-zA-Z0-9_-]|' + NONASCII + '|' + ESCAPE + ')';
// name ::= nmchar+
var NAME = NMCHAR + '+';
// ident ::= '-'? nmstart nmchar*
var IDENT = '-?' + NMSTART + NMCHAR + '*';
// ATKEYWORD ::= '@' ident
var ATKEYWORD = '@' + IDENT;
// HASH ::= '#' name
var HASH = '#' + NAME;
// NUMBER ::= num
var NUMBER = NUM;
// NewRule: union of IDENT, ATKEYWORD, HASH, but excluding #[0-9].
var WORD_TERM = '(?:@?-?' + NMSTART + '|#)' + NMCHAR + '*';
// PERCENTAGE ::= num '%'
var PERCENTAGE = NUM + '%';
// DIMENSION ::= num ident
var DIMENSION = NUM + IDENT;
var NUMERIC_VALUE = NUM + '(?:%|' + IDENT + ')?';
// URI ::= "url(" w (string | urlchar* ) w ")"
var URI = 'url[(]' + W + '(?:' + STRING + '|' + URLCHAR + '*)' + W + '[)]';
// UNICODE-RANGE ::= "U+" [0-9A-F?]{1,6} ('-' [0-9A-F]{1,6})?
var UNICODE_RANGE = 'U[+][0-9A-F?]{1,6}(?:-[0-9A-F]{1,6})?';
// CDO ::= "<\!--"
var CDO = '<\!--';
// CDC ::= "-->"
var CDC = '-->';
// S ::= wc+
var S = WC + '+';
// COMMENT ::= "/*" [^*]* '*'+ ([^/] [^*]* '*'+)* "/"
// Diff: recognizes // comments.
var COMMENT = '/(?:[*][^*]*[*]+(?:[^/][^*]*[*]+)*/|/[^\\n\\f]*)';
// FUNCTION ::= ident '('
// Diff: We exclude url explicitly.
// TODO: should we be tolerant of "fn ("?
var FUNCTION = '(?!url[(])' + IDENT + '[(]';
// INCLUDES ::= "~="
var INCLUDES = '~=';
// DASHMATCH ::= "|="
var DASHMATCH = '[|]=';
// PREFIXMATCH ::= "^="
var PREFIXMATCH = '[^]=';
// SUFFIXMATCH ::= "$="
var SUFFIXMATCH = '[$]=';
// SUBSTRINGMATCH ::= "*="
var SUBSTRINGMATCH = '[*]=';
// NewRule: one rule for all the comparison operators.
var CMP_OPS = '[~|^$*]=';
// CHAR ::= any character not matched by the above rules, except for " or '
// Diff: We exclude / and \ since they are handled above to prevent
// /* without a following */ from combining when comments are concatenated.
var CHAR = '[^"\'\\\\/]|/(?![/*])';
// BOM ::= #xFEFF
var BOM = '\\uFEFF';
var CSS_TOKEN = new RegExp([
BOM, UNICODE_RANGE, URI, FUNCTION, WORD_TERM, STRING, NUMERIC_VALUE,
CDO, CDC, S, COMMENT, CMP_OPS, CHAR].join("|"), 'gi');
var CSS_DECODER = new RegExp('\\\\(?:' + ESCAPE_TAIL + '|' + NL + ')', 'g');
var URL_RE = new RegExp('^url\\(' + W + '["\']?|["\']?' + W + '\\)$', 'gi');
/**
* Decodes CSS escape sequences in a CSS string body.
*/
decodeCss = function (css) {
return css.replace(CSS_DECODER, decodeCssEscape);
};
/**
* Given CSS Text, returns an array of normalized tokens.
* @param {string} cssText
* @return {Array.<string>} tokens where all ignorable token sequences have
* been reduced to a single {@code " "} and all strings and
* {@code url(...)} tokens have been normalized to use double quotes as
* delimiters and to not otherwise contain double quotes.
*/
lexCss = function (cssText) {
// Stringify input. Additionally, insert and remove a non-latin1 character
// to force Firefox 33 to switch to a wide string representation, avoiding
// a performance bug. This workaround should become unnecessary after
// Firefox 34. https://bugzilla.mozilla.org/show_bug.cgi?id=1081175
// https://code.google.com/p/google-caja/issues/detail?id=1941
cssText = ('\uffff' + cssText).replace(/^\uffff/, '');
// // Normalize CRLF & CR to LF.
cssText = cssText.replace(/\r\n?/g, '\n');
// Tokenize.
var tokens = cssText.match(CSS_TOKEN) || [];
var j = 0;
var last = ' ';
for (var i = 0, n = tokens.length; i < n; ++i) {
// Normalize all escape sequences. We will have to re-escape some
// codepoints in string and url(...) bodies but we already know the
// boundaries.
// We might mistakenly treat a malformed identifier like \22\20\22 as a
// string, but that will not break any valid stylesheets since we requote
// and re-escape in string below.
var tok = decodeCss(tokens[i]);
var len = tok.length;
var cc = tok.charCodeAt(0);
tok =
// All strings should be double quoted, and the body should never
// contain a double quote.
(cc == '"'.charCodeAt(0) || cc == '\''.charCodeAt(0))
? escapeCssString(tok.substring(1, len - 1), escapeCssStrChar)
// A breaking ignorable token should is replaced with a single space.
: (cc == '/'.charCodeAt(0) && len > 1 // Comment.
|| tok == '\\' || tok == CDC || tok == CDO || tok == '\ufeff'
// Characters in W.
|| cc <= ' '.charCodeAt(0))
? ' '
// Make sure that all url(...)s are double quoted.
: /url\(/i.test(tok)
? 'url(' + escapeCssString(
tok.replace(URL_RE, ''),
escapeCssUrlChar)
+ ')'
// Escapes in identifier like tokens will have been normalized above.
: tok;
// Merge adjacent space tokens.
if (last != tok || tok != ' ') {
tokens[j++] = last = tok;
}
}
tokens.length = j;
return tokens;
};
})();
// Exports for closure compiler.
if (typeof window !== 'undefined') {
window['lexCss'] = lexCss;
window['decodeCss'] = decodeCss;
}
;
// Copyright (C) 2010 Google Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/**
* @fileoverview
* Implements RFC 3986 for parsing/formatting URIs.
*
* @author mikesamuel@gmail.com
* \@provides URI
* \@overrides window
*/
var URI = (function () {
/**
* creates a uri from the string form. The parser is relaxed, so special
* characters that aren't escaped but don't cause ambiguities will not cause
* parse failures.
*
* @return {URI|null}
*/
function parse(uriStr) {
var m = ('' + uriStr).match(URI_RE_);
if (!m) { return null; }
return new URI(
nullIfAbsent(m[1]),
nullIfAbsent(m[2]),
nullIfAbsent(m[3]),
nullIfAbsent(m[4]),
nullIfAbsent(m[5]),
nullIfAbsent(m[6]),
nullIfAbsent(m[7]));
}
/**
* creates a uri from the given parts.
*
* @param scheme {string} an unencoded scheme such as "http" or null
* @param credentials {string} unencoded user credentials or null
* @param domain {string} an unencoded domain name or null
* @param port {number} a port number in [1, 32768].
* -1 indicates no port, as does null.
* @param path {string} an unencoded path
* @param query {Array.<string>|string|null} a list of unencoded cgi
* parameters where even values are keys and odds the corresponding values
* or an unencoded query.
* @param fragment {string} an unencoded fragment without the "#" or null.
* @return {URI}
*/
function create(scheme, credentials, domain, port, path, query, fragment) {
var uri = new URI(
encodeIfExists2(scheme, URI_DISALLOWED_IN_SCHEME_OR_CREDENTIALS_),
encodeIfExists2(
credentials, URI_DISALLOWED_IN_SCHEME_OR_CREDENTIALS_),
encodeIfExists(domain),
port > 0 ? port.toString() : null,
encodeIfExists2(path, URI_DISALLOWED_IN_PATH_),
null,
encodeIfExists(fragment));
if (query) {
if ('string' === typeof query) {
uri.setRawQuery(query.replace(/[^?&=0-9A-Za-z_\-~.%]/g, encodeOne));
} else {
uri.setAllParameters(query);
}
}
return uri;
}
function encodeIfExists(unescapedPart) {
if ('string' == typeof unescapedPart) {
return encodeURIComponent(unescapedPart);
}
return null;
};
/**
* if unescapedPart is non null, then escapes any characters in it that aren't
* valid characters in a url and also escapes any special characters that
* appear in extra.
*
* @param unescapedPart {string}
* @param extra {RegExp} a character set of characters in [\01-\177].
* @return {string|null} null iff unescapedPart == null.
*/
function encodeIfExists2(unescapedPart, extra) {
if ('string' == typeof unescapedPart) {
return encodeURI(unescapedPart).replace(extra, encodeOne);
}
return null;
};
/** converts a character in [\01-\177] to its url encoded equivalent. */
function encodeOne(ch) {
var n = ch.charCodeAt(0);
return '%' + '0123456789ABCDEF'.charAt((n >> 4) & 0xf) +
'0123456789ABCDEF'.charAt(n & 0xf);
}
/**
* {@updoc
* $ normPath('foo/./bar')
* # 'foo/bar'
* $ normPath('./foo')
* # 'foo'
* $ normPath('foo/.')
* # 'foo'
* $ normPath('foo//bar')
* # 'foo/bar'
* }
*/
function normPath(path) {
return path.replace(/(^|\/)\.(?:\/|$)/g, '$1').replace(/\/{2,}/g, '/');
}
var PARENT_DIRECTORY_HANDLER = new RegExp(
''
// A path break
+ '(/|^)'
// followed by a non .. path element
// (cannot be . because normPath is used prior to this RegExp)
+ '(?:[^./][^/]*|\\.{2,}(?:[^./][^/]*)|\\.{3,}[^/]*)'
// followed by .. followed by a path break.
+ '/\\.\\.(?:/|$)');
var PARENT_DIRECTORY_HANDLER_RE = new RegExp(PARENT_DIRECTORY_HANDLER);
var EXTRA_PARENT_PATHS_RE = /^(?:\.\.\/)*(?:\.\.$)?/;
/**
* Normalizes its input path and collapses all . and .. sequences except for
* .. sequences that would take it above the root of the current parent
* directory.
* {@updoc
* $ collapse_dots('foo/../bar')
* # 'bar'
* $ collapse_dots('foo/./bar')
* # 'foo/bar'
* $ collapse_dots('foo/../bar/./../../baz')
* # 'baz'
* $ collapse_dots('../foo')
* # '../foo'
* $ collapse_dots('../foo').replace(EXTRA_PARENT_PATHS_RE, '')
* # 'foo'
* }
*/
function collapse_dots(path) {
if (path === null) { return null; }
var p = normPath(path);
// Only /../ left to flatten
var r = PARENT_DIRECTORY_HANDLER_RE;
// We replace with $1 which matches a / before the .. because this
// guarantees that:
// (1) we have at most 1 / between the adjacent place,
// (2) always have a slash if there is a preceding path section, and
// (3) we never turn a relative path into an absolute path.
for (var q; (q = p.replace(r, '$1')) != p; p = q) {};
return p;
}
/**
* resolves a relative url string to a base uri.
* @return {URI}
*/
function resolve(baseUri, relativeUri) {
// there are several kinds of relative urls:
// 1. //foo - replaces everything from the domain on. foo is a domain name
// 2. foo - replaces the last part of the path, the whole query and fragment
// 3. /foo - replaces the the path, the query and fragment
// 4. ?foo - replace the query and fragment
// 5. #foo - replace the fragment only
var absoluteUri = baseUri.clone();
// we satisfy these conditions by looking for the first part of relativeUri
// that is not blank and applying defaults to the rest
var overridden = relativeUri.hasScheme();
if (overridden) {
absoluteUri.setRawScheme(relativeUri.getRawScheme());
} else {
overridden = relativeUri.hasCredentials();
}
if (overridden) {
absoluteUri.setRawCredentials(relativeUri.getRawCredentials());
} else {
overridden = relativeUri.hasDomain();
}
if (overridden) {
absoluteUri.setRawDomain(relativeUri.getRawDomain());
} else {
overridden = relativeUri.hasPort();
}
var rawPath = relativeUri.getRawPath();
var simplifiedPath = collapse_dots(rawPath);
if (overridden) {
absoluteUri.setPort(relativeUri.getPort());
simplifiedPath = simplifiedPath
&& simplifiedPath.replace(EXTRA_PARENT_PATHS_RE, '');
} else {
overridden = !!rawPath;
if (overridden) {
// resolve path properly
if (simplifiedPath.charCodeAt(0) !== 0x2f /* / */) { // path is relative
var absRawPath = collapse_dots(absoluteUri.getRawPath() || '')
.replace(EXTRA_PARENT_PATHS_RE, '');
var slash = absRawPath.lastIndexOf('/') + 1;
simplifiedPath = collapse_dots(
(slash ? absRawPath.substring(0, slash) : '')
+ collapse_dots(rawPath))
.replace(EXTRA_PARENT_PATHS_RE, '');
}
} else {
simplifiedPath = simplifiedPath
&& simplifiedPath.replace(EXTRA_PARENT_PATHS_RE, '');
if (simplifiedPath !== rawPath) {
absoluteUri.setRawPath(simplifiedPath);
}
}
}
if (overridden) {
absoluteUri.setRawPath(simplifiedPath);
} else {
overridden = relativeUri.hasQuery();
}
if (overridden) {
absoluteUri.setRawQuery(relativeUri.getRawQuery());
} else {
overridden = relativeUri.hasFragment();
}
if (overridden) {
absoluteUri.setRawFragment(relativeUri.getRawFragment());
}
return absoluteUri;
}
/**
* a mutable URI.
*
* This class contains setters and getters for the parts of the URI.
* The <tt>getXYZ</tt>/<tt>setXYZ</tt> methods return the decoded part -- so
* <code>uri.parse('/foo%20bar').getPath()</code> will return the decoded path,
* <tt>/foo bar</tt>.
*
* <p>The raw versions of fields are available too.
* <code>uri.parse('/foo%20bar').getRawPath()</code> will return the raw path,
* <tt>/foo%20bar</tt>. Use the raw setters with care, since
* <code>URI::toString</code> is not guaranteed to return a valid url if a
* raw setter was used.
*
* <p>All setters return <tt>this</tt> and so may be chained, a la
* <code>uri.parse('/foo').setFragment('part').toString()</code>.
*
* <p>You should not use this constructor directly -- please prefer the factory
* functions {@link uri.parse}, {@link uri.create}, {@link uri.resolve}
* instead.</p>
*
* <p>The parameters are all raw (assumed to be properly escaped) parts, and
* any (but not all) may be null. Undefined is not allowed.</p>
*
* @constructor
*/
function URI(
rawScheme,
rawCredentials, rawDomain, port,
rawPath, rawQuery, rawFragment) {
this.scheme_ = rawScheme;
this.credentials_ = rawCredentials;
this.domain_ = rawDomain;
this.port_ = port;
this.path_ = rawPath;
this.query_ = rawQuery;
this.fragment_ = rawFragment;
/**
* @type {Array|null}
*/
this.paramCache_ = null;
}
/** returns the string form of the url. */
URI.prototype.toString = function () {
var out = [];
if (null !== this.scheme_) { out.push(this.scheme_, ':'); }
if (null !== this.domain_) {
out.push('//');
if (null !== this.credentials_) { out.push(this.credentials_, '@'); }
out.push(this.domain_);
if (null !== this.port_) { out.push(':', this.port_.toString()); }
}
if (null !== this.path_) { out.push(this.path_); }
if (null !== this.query_) { out.push('?', this.query_); }
if (null !== this.fragment_) { out.push('#', this.fragment_); }
return out.join('');
};
URI.prototype.clone = function () {
return new URI(this.scheme_, this.credentials_, this.domain_, this.port_,
this.path_, this.query_, this.fragment_);
};
URI.prototype.getScheme = function () {
// HTML5 spec does not require the scheme to be lowercased but
// all common browsers except Safari lowercase the scheme.
return this.scheme_ && decodeURIComponent(this.scheme_).toLowerCase();
};
URI.prototype.getRawScheme = function () {
return this.scheme_;
};
URI.prototype.setScheme = function (newScheme) {
this.scheme_ = encodeIfExists2(
newScheme, URI_DISALLOWED_IN_SCHEME_OR_CREDENTIALS_);
return this;
};
URI.prototype.setRawScheme = function (newScheme) {
this.scheme_ = newScheme ? newScheme : null;
return this;
};
URI.prototype.hasScheme = function () {
return null !== this.scheme_;
};
URI.prototype.getCredentials = function () {
return this.credentials_ && decodeURIComponent(this.credentials_);
};
URI.prototype.getRawCredentials = function () {
return this.credentials_;
};
URI.prototype.setCredentials = function (newCredentials) {
this.credentials_ = encodeIfExists2(
newCredentials, URI_DISALLOWED_IN_SCHEME_OR_CREDENTIALS_);
return this;
};
URI.prototype.setRawCredentials = function (newCredentials) {
this.credentials_ = newCredentials ? newCredentials : null;
return this;
};
URI.prototype.hasCredentials = function () {
return null !== this.credentials_;
};
URI.prototype.getDomain = function () {
return this.domain_ && decodeURIComponent(this.domain_);
};
URI.prototype.getRawDomain = function () {
return this.domain_;
};
URI.prototype.setDomain = function (newDomain) {
return this.setRawDomain(newDomain && encodeURIComponent(newDomain));
};
URI.prototype.setRawDomain = function (newDomain) {
this.domain_ = newDomain ? newDomain : null;
// Maintain the invariant that paths must start with a slash when the URI
// is not path-relative.
return this.setRawPath(this.path_);
};
URI.prototype.hasDomain = function () {
return null !== this.domain_;
};
URI.prototype.getPort = function () {
return this.port_ && decodeURIComponent(this.port_);
};
URI.prototype.setPort = function (newPort) {
if (newPort) {
newPort = Number(newPort);
if (newPort !== (newPort & 0xffff)) {
throw new Error('Bad port number ' + newPort);
}
this.port_ = '' + newPort;
} else {
this.port_ = null;
}
return this;
};
URI.prototype.hasPort = function () {
return null !== this.port_;
};
URI.prototype.getPath = function () {
return this.path_ && decodeURIComponent(this.path_);
};
URI.prototype.getRawPath = function () {
return this.path_;
};
URI.prototype.setPath = function (newPath) {
return this.setRawPath(encodeIfExists2(newPath, URI_DISALLOWED_IN_PATH_));
};
URI.prototype.setRawPath = function (newPath) {
if (newPath) {
newPath = String(newPath);
this.path_ =
// Paths must start with '/' unless this is a path-relative URL.
(!this.domain_ || /^\//.test(newPath)) ? newPath : '/' + newPath;
} else {
this.path_ = null;
}
return this;
};
URI.prototype.hasPath = function () {
return null !== this.path_;
};
URI.prototype.getQuery = function () {
// From http://www.w3.org/Addressing/URL/4_URI_Recommentations.html
// Within the query string, the plus sign is reserved as shorthand notation
// for a space.
return this.query_ && decodeURIComponent(this.query_).replace(/\+/g, ' ');
};
URI.prototype.getRawQuery = function () {
return this.query_;
};
URI.prototype.setQuery = function (newQuery) {
this.paramCache_ = null;
this.query_ = encodeIfExists(newQuery);
return this;
};
URI.prototype.setRawQuery = function (newQuery) {
this.paramCache_ = null;
this.query_ = newQuery ? newQuery : null;
return this;
};
URI.prototype.hasQuery = function () {
return null !== this.query_;
};
/**
* sets the query given a list of strings of the form
* [ key0, value0, key1, value1, ... ].
*
* <p><code>uri.setAllParameters(['a', 'b', 'c', 'd']).getQuery()</code>
* will yield <code>'a=b&c=d'</code>.
*/
URI.prototype.setAllParameters = function (params) {
if (typeof params === 'object') {
if (!(params instanceof Array)
&& (params instanceof Object
|| Object.prototype.toString.call(params) !== '[object Array]')) {
var newParams = [];
var i = -1;
for (var k in params) {
var v = params[k];
if ('string' === typeof v) {
newParams[++i] = k;
newParams[++i] = v;
}
}
params = newParams;
}
}
this.paramCache_ = null;
var queryBuf = [];
var separator = '';
for (var j = 0; j < params.length;) {
var k = params[j++];
var v = params[j++];
queryBuf.push(separator, encodeURIComponent(k.toString()));
separator = '&';
if (v) {
queryBuf.push('=', encodeURIComponent(v.toString()));
}
}
this.query_ = queryBuf.join('');
return this;
};
URI.prototype.checkParameterCache_ = function () {
if (!this.paramCache_) {
var q = this.query_;
if (!q) {
this.paramCache_ = [];
} else {
var cgiParams = q.split(/[&\?]/);
var out = [];
var k = -1;
for (var i = 0; i < cgiParams.length; ++i) {
var m = cgiParams[i].match(/^([^=]*)(?:=(.*))?$/);
// From http://www.w3.org/Addressing/URL/4_URI_Recommentations.html
// Within the query string, the plus sign is reserved as shorthand
// notation for a space.
out[++k] = decodeURIComponent(m[1]).replace(/\+/g, ' ');
out[++k] = decodeURIComponent(m[2] || '').replace(/\+/g, ' ');
}
this.paramCache_ = out;
}
}
};
/**
* sets the values of the named cgi parameters.
*
* <p>So, <code>uri.parse('foo?a=b&c=d&e=f').setParameterValues('c', ['new'])
* </code> yields <tt>foo?a=b&c=new&e=f</tt>.</p>
*
* @param key {string}
* @param values {Array.<string>} the new values. If values is a single string
* then it will be treated as the sole value.
*/
URI.prototype.setParameterValues = function (key, values) {
// be nice and avoid subtle bugs where [] operator on string performs charAt
// on some browsers and crashes on IE
if (typeof values === 'string') {
values = [ values ];
}
this.checkParameterCache_();
var newValueIndex = 0;
var pc = this.paramCache_;
var params = [];
for (var i = 0, k = 0; i < pc.length; i += 2) {
if (key === pc[i]) {
if (newValueIndex < values.length) {
params.push(key, values[newValueIndex++]);
}
} else {
params.push(pc[i], pc[i + 1]);
}
}
while (newValueIndex < values.length) {
params.push(key, values[newValueIndex++]);
}
this.setAllParameters(params);
return this;
};
URI.prototype.removeParameter = function (key) {
return this.setParameterValues(key, []);
};
/**
* returns the parameters specified in the query part of the uri as a list of
* keys and values like [ key0, value0, key1, value1, ... ].
*
* @return {Array.<string>}
*/
URI.prototype.getAllParameters = function () {
this.checkParameterCache_();
return this.paramCache_.slice(0, this.paramCache_.length);
};
/**
* returns the value<b>s</b> for a given cgi parameter as a list of decoded
* query parameter values.
* @return {Array.<string>}
*/
URI.prototype.getParameterValues = function (paramNameUnescaped) {
this.checkParameterCache_();
var values = [];
for (var i = 0; i < this.paramCache_.length; i += 2) {
if (paramNameUnescaped === this.paramCache_[i]) {
values.push(this.paramCache_[i + 1]);
}
}
return values;
};
/**
* returns a map of cgi parameter names to (non-empty) lists of values.
* @return {Object.<string,Array.<string>>}
*/
URI.prototype.getParameterMap = function (paramNameUnescaped) {
this.checkParameterCache_();
var paramMap = {};
for (var i = 0; i < this.paramCache_.length; i += 2) {
var key = this.paramCache_[i++],
value = this.paramCache_[i++];
if (!(key in paramMap)) {
paramMap[key] = [value];
} else {
paramMap[key].push(value);
}
}
return paramMap;
};
/**
* returns the first value for a given cgi parameter or null if the given
* parameter name does not appear in the query string.
* If the given parameter name does appear, but has no '<tt>=</tt>' following
* it, then the empty string will be returned.
* @return {string|null}
*/
URI.prototype.getParameterValue = function (paramNameUnescaped) {
this.checkParameterCache_();
for (var i = 0; i < this.paramCache_.length; i += 2) {
if (paramNameUnescaped === this.paramCache_[i]) {
return this.paramCache_[i + 1];
}
}
return null;
};
URI.prototype.getFragment = function () {
return this.fragment_ && decodeURIComponent(this.fragment_);
};
URI.prototype.getRawFragment = function () {
return this.fragment_;
};
URI.prototype.setFragment = function (newFragment) {
this.fragment_ = newFragment ? encodeURIComponent(newFragment) : null;
return this;
};
URI.prototype.setRawFragment = function (newFragment) {
this.fragment_ = newFragment ? newFragment : null;
return this;
};
URI.prototype.hasFragment = function () {
return null !== this.fragment_;
};
function nullIfAbsent(matchPart) {
return ('string' == typeof matchPart) && (matchPart.length > 0)
? matchPart
: null;
}
/**
* a regular expression for breaking a URI into its component parts.
*
* <p>http://www.gbiv.com/protocols/uri/rfc/rfc3986.html#RFC2234 says
* As the "first-match-wins" algorithm is identical to the "greedy"
* disambiguation method used by POSIX regular expressions, it is natural and
* commonplace to use a regular expression for parsing the potential five
* components of a URI reference.
*
* <p>The following line is the regular expression for breaking-down a
* well-formed URI reference into its components.
*
* <pre>
* ^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))?
* 12 3 4 5 6 7 8 9
* </pre>
*
* <p>The numbers in the second line above are only to assist readability; they
* indicate the reference points for each subexpression (i.e., each paired
* parenthesis). We refer to the value matched for subexpression <n> as $<n>.
* For example, matching the above expression to
* <pre>
* http://www.ics.uci.edu/pub/ietf/uri/#Related
* </pre>
* results in the following subexpression matches:
* <pre>
* $1 = http:
* $2 = http
* $3 = //www.ics.uci.edu
* $4 = www.ics.uci.edu
* $5 = /pub/ietf/uri/
* $6 = <undefined>
* $7 = <undefined>
* $8 = #Related
* $9 = Related
* </pre>
* where <undefined> indicates that the component is not present, as is the
* case for the query component in the above example. Therefore, we can
* determine the value of the five components as
* <pre>
* scheme = $2
* authority = $4
* path = $5
* query = $7
* fragment = $9
* </pre>
*
* <p>msamuel: I have modified the regular expression slightly to expose the
* credentials, domain, and port separately from the authority.
* The modified version yields
* <pre>
* $1 = http scheme
* $2 = <undefined> credentials -\
* $3 = www.ics.uci.edu domain | authority
* $4 = <undefined> port -/
* $5 = /pub/ietf/uri/ path
* $6 = <undefined> query without ?
* $7 = Related fragment without #
* </pre>
*/
var URI_RE_ = new RegExp(
"^" +
"(?:" +
"([^:/?#]+)" + // scheme
":)?" +
"(?://" +
"(?:([^/?#]*)@)?" + // credentials
"([^/?#:@]*)" + // domain
"(?::([0-9]+))?" + // port
")?" +
"([^?#]+)?" + // path
"(?:\\?([^#]*))?" + // query
"(?:#(.*))?" + // fragment
"$"
);
var URI_DISALLOWED_IN_SCHEME_OR_CREDENTIALS_ = /[#\/\?@]/g;
var URI_DISALLOWED_IN_PATH_ = /[\#\?]/g;
URI.parse = parse;
URI.create = create;
URI.resolve = resolve;
URI.collapse_dots = collapse_dots; // Visible for testing.
// lightweight string-based api for loadModuleMaker
URI.utils = {
mimeTypeOf: function (uri) {
var uriObj = parse(uri);
if (/\.html$/.test(uriObj.getPath())) {
return 'text/html';
} else {
return 'application/javascript';
}
},
resolve: function (base, uri) {
if (base) {
return resolve(parse(base), parse(uri)).toString();
} else {
return '' + uri;
}
}
};
return URI;
})();
// Exports for closure compiler.
if (typeof window !== 'undefined') {
window['URI'] = URI;
}
;
// Copyright (C) 2011 Google Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/**
* @fileoverview
* JavaScript support for client-side CSS sanitization.
* The CSS property schema API is defined in CssPropertyPatterns.java which
* is used to generate css-defs.js.
*
* @author mikesamuel@gmail.com
* \@requires CSS_PROP_BIT_GLOBAL_NAME
* \@requires CSS_PROP_BIT_HASH_VALUE
* \@requires CSS_PROP_BIT_NEGATIVE_QUANTITY
* \@requires CSS_PROP_BIT_PROPERTY_NAME
* \@requires CSS_PROP_BIT_QUANTITY
* \@requires CSS_PROP_BIT_QSTRING
* \@requires CSS_PROP_BIT_UNRESERVED_WORD
* \@requires CSS_PROP_BIT_URL
* \@requires cssSchema
* \@requires decodeCss
* \@requires html4
* \@requires URI
* \@overrides window
* \@requires parseCssStylesheet
* \@provides sanitizeCssProperty
* \@provides sanitizeCssSelectorList
* \@provides sanitizeStylesheet
* \@provides sanitizeStylesheetWithExternals
* \@provides sanitizeMediaQuery
*/
var sanitizeCssProperty = undefined;
var sanitizeCssSelectorList = undefined;
var sanitizeStylesheet = undefined;
var sanitizeStylesheetWithExternals = undefined;
var sanitizeMediaQuery = undefined;
(function () {
var NOEFFECT_URL = 'url("about:blank")';
/**
* The set of characters that need to be normalized inside url("...").
* We normalize newlines because they are not allowed inside quoted strings,
* normalize quote characters, angle-brackets, and asterisks because they
* could be used to break out of the URL or introduce targets for CSS
* error recovery. We normalize parentheses since they delimit unquoted
* URLs and calls and could be a target for error recovery.
*/
var NORM_URL_REGEXP = /[\n\f\r\"\'()*<>]/g;
/** The replacements for NORM_URL_REGEXP. */
var NORM_URL_REPLACEMENTS = {
'\n': '%0a',
'\f': '%0c',
'\r': '%0d',
'"': '%22',
'\'': '%27',
'(': '%28',
')': '%29',
'*': '%2a',
'<': '%3c',
'>': '%3e'
};
function normalizeUrl(s) {
if ('string' === typeof s) {
return 'url("' + s.replace(NORM_URL_REGEXP, normalizeUrlChar) + '")';
} else {
return NOEFFECT_URL;
}
}
function normalizeUrlChar(ch) {
return NORM_URL_REPLACEMENTS[ch];
}
// From RFC3986
var URI_SCHEME_RE = new RegExp(
'^' +
'(?:' +
'([^:\/?# ]+)' + // scheme
':)?'
);
var ALLOWED_URI_SCHEMES = /^(?:https?|mailto)$/i;
function resolveUri(baseUri, uri) {
if (baseUri) {
return URI.utils.resolve(baseUri, uri);
}
return uri;
}
function safeUri(uri, prop, naiveUriRewriter) {
if (!naiveUriRewriter) { return null; }
var parsed = ('' + uri).match(URI_SCHEME_RE);
if (parsed && (!parsed[1] || ALLOWED_URI_SCHEMES.test(parsed[1]))) {
return naiveUriRewriter(uri, prop);
} else {
return null;
}
}
function withoutVendorPrefix(ident) {
// http://stackoverflow.com/a/5411098/20394 has a fairly extensive list
// of vendor prefices.
// Blink has not declared a vendor prefix distinct from -webkit-
// and http://css-tricks.com/tldr-on-vendor-prefix-drama/ discusses
// how Mozilla recognizes some -webkit-
// http://wiki.csswg.org/spec/vendor-prefixes talks more about
// cross-implementation, and lists other prefixes.
// Note: info is duplicated in CssValidator.java
return ident.replace(
/^-(?:apple|css|epub|khtml|moz|mso?|o|rim|wap|webkit|xv)-(?=[a-z])/, '');
}
/**
* Given a series of normalized CSS tokens, applies a property schema, as
* defined in CssPropertyPatterns.java, and sanitizes the tokens in place.
* @param property a property name.
* @param tokens as parsed by lexCss. Modified in place.
* @param opt_naiveUriRewriter a URI rewriter; an object with a "rewrite"
* function that takes a URL and returns a safe URL.
* @param opt_baseURI a URI against which all relative URLs in tokens will
* be resolved.
* @param opt_idSuffix {string} appended to all IDs to scope them.
*/
sanitizeCssProperty = (function () {
function unionArrays(arrs) {
var map = {};
for (var i = arrs.length; --i >= 0;) {
var arr = arrs[i];
for (var j = arr.length; --j >= 0;) {
map[arr[j]] = ALLOWED_LITERAL;
}
}
return map;
}
// Used as map value to avoid hasOwnProperty checks.
var ALLOWED_LITERAL = {};
return function sanitize(
property, tokens, opt_naiveUriRewriter, opt_baseUri, opt_idSuffix) {
var propertyKey = withoutVendorPrefix(property);
var propertySchema = cssSchema[propertyKey];
// If the property isn't recognized, elide all tokens.
if (!propertySchema || 'object' !== typeof propertySchema) {
tokens.length = 0;
return;
}
var propBits = propertySchema['cssPropBits'];
/**
* Recurse to apply the appropriate function schema to the function call
* that starts at {@code tokens[start]}.
* @param {Array.<string>} tokens an array of CSS token that is modified
* in place so that all tokens involved in the function call
* (from {@code tokens[start]} to a close parenthesis) are folded to
* one token.
* @param {number} start an index into tokens of a function token like
* {@code 'name('}.
* @return the replacement function or the empty string if the function
* call is not both well-formed and allowed.
*/
function sanitizeFunctionCall(tokens, start) {
var parenDepth = 1, end = start + 1, n = tokens.length;
while (end < n && parenDepth) {
var token = tokens[end++];
// Decrement if we see a close parenthesis, and increment if we
// see a function. Since url(...) are whole tokens, they will not
// affect the token scanning.
parenDepth += (token === ')' ? -1 : /^[^"']*\($/.test(token));
}
// Allow error-recovery from unclosed functions by ignoring the call and
// so allowing resumption at the next ';'.
if (!parenDepth) {
var fnToken = tokens[start].toLowerCase();
var bareFnToken = withoutVendorPrefix(fnToken);
// Cut out the originals, so the caller can step by one token.
var fnTokens = tokens.splice(start, end - start, '');
var fns = propertySchema['cssFns'];
// Look for a function that matches the name.
for (var i = 0, nFns = fns.length; i < nFns; ++i) {
if (fns[i].substring(0, bareFnToken.length) == bareFnToken) {
fnTokens[0] = fnTokens[fnTokens.length - 1] = '';
// Recurse and sanitize the function parameters.
sanitize(
fns[i],
// The actual parameters to the function.
fnTokens,
opt_naiveUriRewriter, opt_baseUri);
// Reconstitute the function from its parameter tokens.
return fnToken + fnTokens.join(' ') + ')';
}
}
}
return '';
}
// Used to determine whether to treat quoted strings as URLs or
// plain text content, and whether unrecognized keywords can be quoted
// to treat ['Arial', 'Black'] equivalently to ['"Arial Black"'].
var stringDisposition =
propBits & (CSS_PROP_BIT_URL | CSS_PROP_BIT_UNRESERVED_WORD);
// Used to determine what to do with unreserved words.
var identDisposition =
propBits & (CSS_PROP_BIT_GLOBAL_NAME | CSS_PROP_BIT_PROPERTY_NAME);
// Used to join unquoted keywords into a single quoted string.
var lastQuoted = NaN;
var i = 0, k = 0;
for (;i < tokens.length; ++i) {
// Has the effect of normalizing hex digits, keywords,
// and function names.
var token = tokens[i].toLowerCase();
var cc = token.charCodeAt(0), cc1, cc2, isnum1, isnum2, end;
var litGroup, litMap;
token = (
// Strip out spaces. Normally cssparser.js dumps these, but we
// strip them out in case the content doesn't come via cssparser.js.
(cc === ' '.charCodeAt(0)) ? ''
: (cc === '"'.charCodeAt(0)) ? ( // Quoted string.
(stringDisposition === CSS_PROP_BIT_URL)
? (opt_naiveUriRewriter
// Sanitize and convert to url("...") syntax.
// Treat url content as case-sensitive.
? (normalizeUrl(
// Rewrite to a safe URI.
safeUri(
// Convert to absolute URL
resolveUri(
opt_baseUri,
// Strip off quotes
decodeCss(tokens[i].substring(1, token.length - 1))),
propertyKey,
opt_naiveUriRewriter)))
: '')
: ((propBits & CSS_PROP_BIT_QSTRING)
// Ambiguous when more than one bit set in disposition.
&& !(stringDisposition & (stringDisposition - 1)))
? token
// Drop if quoted strings not allowed.
: ''
)
// inherit is always allowed.
: token === 'inherit'
? token
: (
litGroup = propertySchema['cssLitGroup'],
litMap = (litGroup
? (propertySchema['cssLitMap']
// Lazily compute the union from litGroup.
|| (propertySchema['cssLitMap'] =
unionArrays(litGroup)))
: ALLOWED_LITERAL), // A convenient empty object.
(litMap[withoutVendorPrefix(token)] === ALLOWED_LITERAL)
)
// Token is in the literal map or matches extra.
? token
// Preserve hash color literals if allowed.
: (cc === '#'.charCodeAt(0) && /^#(?:[0-9a-f]{3}){1,2}$/.test(token))
? (propBits & CSS_PROP_BIT_HASH_VALUE ? token : '')
: ('0'.charCodeAt(0) <= cc && cc <= '9'.charCodeAt(0))
// A number starting with a digit.
? ((propBits & CSS_PROP_BIT_QUANTITY) ? token : '')
// Normalize quantities so they don't start with a '.' or '+' sign and
// make sure they all have an integer component so can't be confused
// with a dotted identifier.
// This can't be done in the lexer since ".4" is a valid rule part.
: (cc1 = token.charCodeAt(1),
cc2 = token.charCodeAt(2),
isnum1 = '0'.charCodeAt(0) <= cc1 && cc1 <= '9'.charCodeAt(0),
isnum2 = '0'.charCodeAt(0) <= cc2 && cc2 <= '9'.charCodeAt(0),
// +.5 -> 0.5 if allowed.
(cc === '+'.charCodeAt(0)
&& (isnum1 || (cc1 === '.'.charCodeAt(0) && isnum2))))
? ((propBits & CSS_PROP_BIT_QUANTITY)
? ((isnum1 ? '' : '0') + token.substring(1))
: '')
// -.5 -> -0.5 if allowed otherwise -> 0 if quantities allowed.
: (cc === '-'.charCodeAt(0)
&& (isnum1 || (cc1 === '.'.charCodeAt(0) && isnum2)))
? ((propBits & CSS_PROP_BIT_NEGATIVE_QUANTITY)
? ((isnum1 ? '-' : '-0') + token.substring(1))
: ((propBits & CSS_PROP_BIT_QUANTITY) ? '0' : ''))
// .5 -> 0.5 if allowed.
: (cc === '.'.charCodeAt(0) && isnum1)
? ((propBits & CSS_PROP_BIT_QUANTITY) ? '0' + token : '')
// Handle url("...") by rewriting the body.
: ('url("' === token.substring(0, 5))
? ((opt_naiveUriRewriter && (propBits & CSS_PROP_BIT_URL))
? normalizeUrl(safeUri(resolveUri(opt_baseUri,
tokens[i].substring(5, token.length - 2)),
propertyKey,
opt_naiveUriRewriter))
: '')
// Handle func(...) by recursing.
// Functions start at a token like "name(" and end with a ")" taking
// into account nesting.
: (token.charAt(token.length-1) === '(')
? sanitizeFunctionCall(tokens, i)
: (identDisposition
&& /^-?[a-z_][\w\-]*$/.test(token) && !/__$/.test(token))
? (opt_idSuffix && identDisposition === CSS_PROP_BIT_GLOBAL_NAME
? tokens[i] + opt_idSuffix // use original token, not lowercased
: (identDisposition === CSS_PROP_BIT_PROPERTY_NAME
&& cssSchema[token]
&& 'number' === typeof cssSchema[token].cssPropBits)
? token
: '')
: (/^\w+$/.test(token)
&& stringDisposition === CSS_PROP_BIT_UNRESERVED_WORD
&& (propBits & CSS_PROP_BIT_QSTRING))
// Quote unrecognized keywords so font names like
// Arial Bold
// ->
// "Arial Bold"
? (lastQuoted+1 === k
// If the last token was also a keyword that was quoted, then
// combine this token into that.
? (tokens[lastQuoted] = (
tokens[lastQuoted].substring(0, tokens[lastQuoted].length-1)
+ ' ' + token + '"'),
token = '')
: (lastQuoted = k, '"' + token + '"'))
// Disallowed.
: '');
if (token) {
tokens[k++] = token;
}
}
// For single URL properties, if the URL failed to pass the sanitizer,
// then just drop it.
if (k === 1 && tokens[0] === NOEFFECT_URL) { k = 0; }
tokens.length = k;
};
})();
// Note, duplicated in CssRewriter.java
// Constructed from
// https://developer.mozilla.org/en-US/docs/Web/CSS/Reference
// https://developer.mozilla.org/en-US/docs/Web/CSS/Pseudo-classes
// http://dev.w3.org/csswg/selectors4/
var PSEUDO_SELECTOR_WHITELIST =
new RegExp(
'^(active|after|before|blank|checked|default|disabled'
+ '|drop|empty|enabled|first|first-child|first-letter'
+ '|first-line|first-of-type|fullscreen|focus|hover'
+ '|in-range|indeterminate|invalid|last-child|last-of-type'
+ '|left|link|only-child|only-of-type|optional|out-of-range'
+ '|placeholder-shown|read-only|read-write|required|right'
+ '|root|scope|user-error|valid|visited'
+ ')$');
// Set of punctuation tokens that are child/sibling selectors.
var COMBINATOR = {};
COMBINATOR['>'] = COMBINATOR['+'] = COMBINATOR['~'] = COMBINATOR;
/**
* Given a series of tokens, returns a list of sanitized selectors.
* @param {Array.<string>} selectors In the form produced by csslexer.js.
* @param {{
* containerClass: ?string,
* idSuffix: string,
* tagPolicy: function(string, Array.<string>): ?Array.<string>,
* virtualizeAttrName: ?function(string, string): ?string
* }} virtualization An object like <pre<{
* containerClass: class name prepended to all selectors to scope them (if
* not null)
* idSuffix: appended to all IDs to scope them
* tagPolicy: As in html-sanitizer, used for rewriting element names.
* virtualizeAttrName: Rewrite a single attribute name for attribute
* selectors, or return null if not possible. Should be consistent
* with tagPolicy if possible.
* }</pre>
* If containerClass is {@code "sfx"} and idSuffix is {@code "-sfx"}, the
* selector
* {@code ["a", "#foo", " ", "b", ".bar"]} will be namespaced to
* {@code [".sfx", " ", "a", "#foo-sfx", " ", "b", ".bar"]}.
* @param {function(Array.<string>): boolean} opt_onUntranslatableSelector
* When a selector cannot be translated, this function is called with the
* non-whitespace/comment tokens comprising the selector and returns a
* value indicating whether to continue processing the selector list.
* If it returns falsey, then processing is aborted and null is returned.
* If not present or it returns truthy, then the complex selector is
* dropped from the selector list.
* @return {Array.<string>}? an array of sanitized selectors.
* Null when the untraslatable compound selector handler aborts processing.
*/
sanitizeCssSelectorList = function(
selectors, virtualization, opt_onUntranslatableSelector) {
var containerClass = virtualization.containerClass;
var idSuffix = virtualization.idSuffix;
var tagPolicy = virtualization.tagPolicy;
var sanitized = [];
// Remove any spaces that are not operators.
var k = 0, i, inBrackets = 0, tok;
for (i = 0; i < selectors.length; ++i) {
tok = selectors[i];
if (
(tok == '(' || tok == '[') ? (++inBrackets, true)
: (tok == ')' || tok == ']') ? (inBrackets && --inBrackets, true)
: !(selectors[i] == ' '
&& (inBrackets || COMBINATOR[selectors[i-1]] === COMBINATOR
|| COMBINATOR[selectors[i+1]] === COMBINATOR))
) {
selectors[k++] = selectors[i];
}
}
selectors.length = k;
// Split around commas. If there is an error in one of the comma separated
// bits, we throw the whole away, but the failure of one selector does not
// affect others except that opt_onUntranslatableSelector allows one to
// treat the entire output as unusable.
var n = selectors.length, start = 0;
for (i = 0; i < n; ++i) {
if (selectors[i] === ',') { // TODO: ignore ',' inside brackets.
if (!processComplexSelector(start, i)) { return null; }
start = i+1;
}
}
if (!processComplexSelector(start, n)) { return null; }
function processComplexSelector(start, end) {
// Space around commas is not an operator.
if (selectors[start] === ' ') { ++start; }
if (end-1 !== start && selectors[end] === ' ') { --end; }
// Split the selector into element selectors, content around
// space (ancestor operator) and '>' (descendant operator).
var out = [];
var lastOperator = start;
var valid = true; // True iff out contains a valid complex selector.
for (var i = start; valid && i < end; ++i) {
var tok = selectors[i];
if (COMBINATOR[tok] === COMBINATOR || tok === ' ') {
// We've found the end of a single link in the selector chain.
if (!processCompoundSelector(lastOperator, i, tok)) {
valid = false;
} else {
lastOperator = i+1;
}
}
}
if (!processCompoundSelector(lastOperator, end, '')) {
valid = false;
}
function processCompoundSelector(start, end, combinator) {
// Split the element selector into four parts.
// DIV.foo#bar[href]:hover
// ^ ^ ^
// el classes attrs pseudo
var element, classId, attrs, pseudoSelector,
tok, // The current token
// valid implies the parts above comprise a sanitized selector.
valid = true;
element = '';
if (start < end) {
tok = selectors[start];
if (tok === '*') {
++start;
element = tok;
} else if (/^[a-zA-Z]/.test(tok)) { // is an element selector
var decision = tagPolicy(tok.toLowerCase(), []);
if (decision) {
if ('tagName' in decision) {
tok = decision['tagName'];
}
++start;
element = tok;
}
}
}
classId = '';
attrs = '';
pseudoSelector = '';
for (;valid && start < end; ++start) {
tok = selectors[start];
if (tok.charAt(0) === '#') {
if (/^#_|__$|[^\w#:\-]/.test(tok)) {
valid = false;
} else {
// Rewrite ID elements to include the suffix.
classId += tok + idSuffix;
}
} else if (tok === '.') {
if (++start < end
&& /^[0-9A-Za-z:_\-]+$/.test(tok = selectors[start])
&& !/^_|__$/.test(tok)) {
classId += '.' + tok;
} else {
valid = false;
}
} else if (start + 1 < end && selectors[start] === '[') {
++start;
var vAttr = selectors[start++].toLowerCase();
// Schema lookup for type information
var atype = html4.ATTRIBS[element + '::' + vAttr];
if (atype !== +atype) { atype = html4.ATTRIBS['*::' + vAttr]; }
var rAttr;
// Consult policy
// TODO(kpreid): Making this optional is a kludge to avoid changing
// the public interface until we have a more well-structured design.
if (virtualization.virtualizeAttrName) {
rAttr = virtualization.virtualizeAttrName(element, vAttr);
if (typeof rAttr !== 'string') {
// rejected
valid = false;
rAttr = vAttr;
}
// don't reject even if not in schema
if (valid && atype !== +atype) {
atype = html4.atype['NONE'];
}
} else {
rAttr = vAttr;
if (atype !== +atype) { // not permitted according to schema
valid = false;
}
}
var op = '', value = '', ignoreCase = false;
if (/^[~^$*|]?=$/.test(selectors[start])) {
op = selectors[start++];
value = selectors[start++];
// Quote identifier values.
if (/^[0-9A-Za-z:_\-]+$/.test(value)) {
value = '"' + value + '"';
} else if (value === ']') {
value = '""';
--start;
}
// Reject unquoted values.
if (!/^"([^\"\\]|\\.)*"$/.test(value)) {
valid = false;
}
ignoreCase = selectors[start] === "i";
if (ignoreCase) { ++start; }
}
if (selectors[start] !== ']') {
++start;
valid = false;
}
// TODO: replace this with a lookup table that also provides a
// function from operator and value to testable value.
switch (atype) {
case html4.atype['CLASSES']:
case html4.atype['LOCAL_NAME']:
case html4.atype['NONE']:
break;
case html4.atype['GLOBAL_NAME']:
case html4.atype['ID']:
case html4.atype['IDREF']:
if ((op === '=' || op === '~=' || op === '$=')
&& value != '""' && !ignoreCase) {
// The suffix is case-sensitive, so we can't translate case
// ignoring matches.
value = '"'
+ value.substring(1, value.length-1) + idSuffix
+ '"';
} else if (op === '|=' || op === '') {
// Ok. a|=b -> a == b || a.startsWith(b + "-") and since we
// use "-" to separate the suffix from the identifier, we can
// allow this through unmodified.
// Existence checks are also ok.
} else {
// Can't correctly handle prefix and substring operators
// without leaking information about the suffix.
valid = false;
}
break;
case html4.atype['URI']:
case html4.atype['URI_FRAGMENT']:
// URIs are rewritten, so we can't meanginfully translate URI
// selectors besides the common a[href] one that is used to
// distinguish links from naming anchors.
if (op !== '') { valid = false; }
break;
// TODO: IDREFS
default:
valid = false;
}
if (valid) {
attrs += '[' + rAttr.replace(/[^\w-]/g, '\\$&') + op + value +
(ignoreCase ? ' i]' : ']');
}
} else if (start < end && selectors[start] === ':') {
tok = selectors[++start];
if (PSEUDO_SELECTOR_WHITELIST.test(tok)) {
pseudoSelector += ':' + tok;
} else {
break;
}
} else {
break; // Unrecognized token.
}
}
if (start !== end) { // Tokens not consumed.
valid = false;
}
if (valid) {
// ':' is allowed in identifiers, but is also the
// pseudo-selector separator, so ':' in preceding parts needs to
// be escaped.
var selector = (element + classId).replace(/[^ .*#\w-]/g, '\\$&')
+ attrs + pseudoSelector + combinator;
if (selector) { out.push(selector); }
}
return valid;
}
if (valid) {
if (out.length) {
var safeSelector = out.join('');
// Namespace the selector so that it only matches under
// a node with suffix in its CLASS attribute.
if (containerClass !== null) {
safeSelector = '.' + containerClass + ' ' + safeSelector;
}
sanitized.push(safeSelector);
} // else nothing there.
return true;
} else {
return !opt_onUntranslatableSelector
|| opt_onUntranslatableSelector(selectors.slice(start, end));
}
}
return sanitized;
};
(function () {
var MEDIA_TYPE =
'(?:'
+ 'all|aural|braille|embossed|handheld|print'
+ '|projection|screen|speech|tty|tv'
+ ')';
// A white-list of media features extracted from the "Pseudo-BNF" in
// http://dev.w3.org/csswg/mediaqueries4/#media1 and
// https://developer.mozilla.org/en-US/docs/Web/Guide/CSS/Media_queries
var MEDIA_FEATURE =
'(?:'
+ '(?:min-|max-)?'
+ '(?:' + (
'(?:device-)?'
+ '(?:aspect-ratio|height|width)'
+ '|color(?:-index)?'
+ '|monochrome'
+ '|orientation'
+ '|resolution'
)
+ ')'
+ '|grid'
+ '|hover'
+ '|luminosity'
+ '|pointer'
+ '|scan'
+ '|script'
+ ')';
var LENGTH_UNIT = '(?:p[cxt]|[cem]m|in|dpi|dppx|dpcm|%)';
var CSS_VALUE =
'-?(?:'
+ '[a-z]\\w+(?:-\\w+)*' // An identifier
// A length or scalar quantity, or a rational number.
// dev.w3.org/csswg/mediaqueries4/#values introduces a ratio value-type
// to allow matching aspect ratios like "4 / 3".
+ '|\\d+(?: / \\d+|(?:\\.\\d+)?' + LENGTH_UNIT + '?)'
+ ')';
var MEDIA_EXPR =
'\\( ' + MEDIA_FEATURE + ' (?:' + ': ' + CSS_VALUE + ' )?\\)';
var MEDIA_QUERY =
'(?:'
+ '(?:(?:(?:only|not) )?' + MEDIA_TYPE + '|' + MEDIA_EXPR + ')'
// We use 'and ?' since 'and(' is a single CSS function token while
// 'and (' parses to two separate tokens -- IDENT "and", DELIM "(".
+ '(?: and ?' + MEDIA_EXPR + ')*'
+ ')';
var STARTS_WITH_KEYWORD_REGEXP = /^\w/;
var MEDIA_QUERY_LIST_REGEXP = new RegExp(
'^' + MEDIA_QUERY + '(?: , ' + MEDIA_QUERY + ')*' + '$',
'i'
);
/**
* Sanitizes a media query as defined in
* http://dev.w3.org/csswg/mediaqueries4/#syntax
* <blockquote>
* Media Queries allow authors to adapt the style applied to a document
* based on the environment the document is being rendered in.
* </blockquote>
*
* @param {Array.<string>} cssTokens an array of tokens of the kind produced
* by cssLexers.
* @return {string} a CSS media query. This may be the empty string, or if
* the input is invalid, then a query that is always false.
*/
sanitizeMediaQuery = function (cssTokens) {
cssTokens = cssTokens.slice();
// Strip out space tokens.
var nTokens = cssTokens.length, k = 0;
for (var i = 0; i < nTokens; ++i) {
var tok = cssTokens[i];
if (tok != ' ') { cssTokens[k++] = tok; }
}
cssTokens.length = k;
var css = cssTokens.join(' ');
css = (
!css.length ? '' // Always true per the spec.
: !(MEDIA_QUERY_LIST_REGEXP.test(css)) ? 'not all' // Always false.
// Emit as-is if it starts with 'only', 'not' or a media type.
: STARTS_WITH_KEYWORD_REGEXP.test(css) ? css
: 'not all , ' + css // Not ambiguous with a URL.
);
return css;
};
}());
(function () {
/**
* Extracts a url out of an at-import rule of the form:
* \@import "mystyle.css";
* \@import url("mystyle.css");
*
* Returns null if no valid url was found.
*/
function cssParseUri(candidate) {
var string1 = /^\s*["]([^"]*)["]\s*$/;
var string2 = /^\s*[']([^']*)[']\s*$/;
var url1 = /^\s*url\s*[(]["]([^"]*)["][)]\s*$/;
var url2 = /^\s*url\s*[(][']([^']*)['][)]\s*$/;
// Not officially part of the CSS2.1 grammar
// but supported by Chrome
var url3 = /^\s*url\s*[(]([^)]*)[)]\s*$/;
var match;
if ((match = string1.exec(candidate))) {
return match[1];
} else if ((match = string2.exec(candidate))) {
return match[1];
} else if ((match = url1.exec(candidate))) {
return match[1];
} else if ((match = url2.exec(candidate))) {
return match[1];
} else if ((match = url3.exec(candidate))) {
return match[1];
}
return null;
}
/**
* @param {string} baseUri a string against which relative urls are
* resolved.
* @param {string} cssText a string containing a CSS stylesheet.
* @param {{
* containerClass: ?string,
* idSuffix: string,
* tagPolicy: function(string, Array.<string>): ?Array.<string>,
* virtualizeAttrName: ?function(string, string): ?string
* }} virtualization An object like <pre<{
* containerClass: class name prepended to all selectors to scope them (if
* not null)
* idSuffix: appended to all IDs to scope them
* tagPolicy: As in html-sanitizer, used for rewriting element names.
* virtualizeAttrName: Rewrite a single attribute name for attribute
* selectors, or return null if not possible. Should be consistent
* with tagPolicy if possible. Optional.
* }</pre>
* If containerClass is {@code "sfx"} and idSuffix is {@code "-sfx"}, the
* selector
* {@code ["a", "#foo", " ", "b", ".bar"]} will be namespaced to
* {@code [".sfx", " ", "a", "#foo-sfx", " ", "b", ".bar"]}.
* @param {function(string, string)} naiveUriRewriter maps URLs of media
* (images, sounds) that appear as CSS property values to sanitized
* URLs or null if the URL should not be allowed as an external media
* file in sanitized CSS.
* @param {undefined|function({toString: function ():string}, boolean)}
* continuation
* callback that receives the result of loading imported CSS.
* The callback is called with
* (cssContent : function ():string, moreToCome : boolean)
* where cssContent is the CSS at the imported URL, and moreToCome is
* true when the external URL itself loaded other external URLs.
* If the output of the original call is stringified when moreToCome is
* false, then it will be complete.
* @param {Array.<number>} opt_importCount the number of imports that need
* to be satisfied before there is no more pending content.
* @return {{result:{toString:function ():string},moreToCome:boolean}}
* the CSS text, and a flag that indicates whether there are pending
* imports that will be passed to continuation.
*/
function sanitizeStylesheetInternal(
baseUri, cssText, virtualization, naiveUriRewriter, naiveUriFetcher,
continuation, opt_importCount) {
var safeCss = void 0;
// Return a result with moreToCome===true when the last import has been
// sanitized.
var importCount = opt_importCount || [0];
// A stack describing the { ... } regions.
// Null elements indicate blocks that should not be emitted.
var blockStack = [];
// True when the content of the current block should be left off safeCss.
var elide = false;
parseCssStylesheet(
cssText,
{
'startStylesheet': function () {
safeCss = [];
},
'endStylesheet': function () {
},
'startAtrule': function (atIdent, headerArray) {
if (elide) {
atIdent = null;
} else if (atIdent === '@media') {
safeCss.push('@media', ' ', sanitizeMediaQuery(headerArray));
} else if (atIdent === '@keyframes'
|| atIdent === '@-webkit-keyframes') {
var animationId = headerArray[0];
if (headerArray.length === 1
&& !/__$|[^\w\-]/.test(animationId)) {
safeCss.push(
atIdent, ' ', animationId + virtualization.idSuffix);
atIdent = '@keyframes';
} else {
atIdent = null;
}
} else {
if (atIdent === '@import' && headerArray.length > 0) {
atIdent = null;
if ('function' === typeof continuation) {
var mediaQuery = sanitizeMediaQuery(headerArray.slice(1));
if (mediaQuery !== 'not all') {
++importCount[0];
var placeholder = [];
safeCss.push(placeholder);
var cssUrl = safeUri(
resolveUri(baseUri, cssParseUri(headerArray[0])),
function(result) {
var sanitized = sanitizeStylesheetInternal(
cssUrl, result.html, virtualization,
naiveUriRewriter, naiveUriFetcher,
continuation, importCount);
--importCount[0];
var safeImportedCss = mediaQuery
? {
toString: function () {
return (
'@media ' + mediaQuery + ' {'
+ sanitized.result + '}'
);
}
}
: sanitized.result;
placeholder[0] = safeImportedCss;
continuation(safeImportedCss, !!importCount[0]);
},
naiveUriFetcher);
}
} else {
// TODO: Use a logger instead.
if (window.console) {
window.console.log(
'@import ' + headerArray.join(' ') + ' elided');
}
}
}
}
elide = !atIdent;
blockStack.push(atIdent);
},
'endAtrule': function () {
blockStack.pop();
if (!elide) {
safeCss.push(';');
}
checkElide();
},
'startBlock': function () {
// There are no bare blocks in CSS, so we do not change the
// block stack here, but instead in the events that bracket
// blocks.
if (!elide) {
safeCss.push('{');
}
},
'endBlock': function () {
if (!elide) {
safeCss.push('}');
elide = true; // skip any semicolon from endAtRule.
}
},
'startRuleset': function (selectorArray) {
if (!elide) {
var selector = void 0;
if (blockStack[blockStack.length - 1] === '@keyframes') {
// Allow [from | to | <percentage>]
selector = selectorArray.join(' ')
.match(/^ *(?:from|to|\d+(?:\.\d+)?%) *(?:, *(?:from|to|\d+(?:\.\d+)?%) *)*$/i);
elide = !selector;
if (selector) { selector = selector[0].replace(/ +/g, ''); }
} else {
var selectors = sanitizeCssSelectorList(
selectorArray, virtualization);
if (!selectors || !selectors.length) {
elide = true;
} else {
selector = selectors.join(', ');
}
}
if (!elide) {
safeCss.push(selector, '{');
}
}
blockStack.push(null);
},
'endRuleset': function () {
blockStack.pop();
if (!elide) {
safeCss.push('}');
}
checkElide();
},
'declaration': function (property, valueArray) {
if (!elide) {
var isImportant = false;
var nValues = valueArray.length;
if (nValues >= 2
&& valueArray[nValues - 2] === '!'
&& valueArray[nValues - 1].toLowerCase() === 'important') {
isImportant = true;
valueArray.length -= 2;
}
sanitizeCssProperty(
property, valueArray, naiveUriRewriter, baseUri,
virtualization.idSuffix);
if (valueArray.length) {
safeCss.push(
property, ':', valueArray.join(' '),
isImportant ? ' !important;' : ';');
}
}
}
});
function checkElide() {
elide = blockStack.length && blockStack[blockStack.length-1] === null;
}
return {
result : { toString: function () { return safeCss.join(''); } },
moreToCome : !!importCount[0]
};
}
sanitizeStylesheet = function (
baseUri, cssText, virtualization, naiveUriRewriter) {
return sanitizeStylesheetInternal(
baseUri, cssText, virtualization,
naiveUriRewriter, undefined, undefined).result.toString();
};
sanitizeStylesheetWithExternals = function (
baseUri, cssText, virtualization, naiveUriRewriter, naiveUriFetcher,
continuation) {
return sanitizeStylesheetInternal(
baseUri, cssText, virtualization,
naiveUriRewriter, naiveUriFetcher, continuation);
};
})();
})();
// Exports for closure compiler.
if (typeof window !== 'undefined') {
window['sanitizeCssProperty'] = sanitizeCssProperty;
window['sanitizeCssSelectorList'] = sanitizeCssSelectorList;
window['sanitizeStylesheet'] = sanitizeStylesheet;
window['sanitizeMediaQuery'] = sanitizeMediaQuery;
}
;
// Copyright (C) 2010 Google Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/**
* @fileoverview
* Utilities for dealing with CSS source code.
*
* @author mikesamuel@gmail.com
* \@requires lexCss
* \@overrides window
* \@provides parseCssStylesheet, parseCssDeclarations
*/
// The Turkish i seems to be a non-issue, but abort in case it is.
if ('I'.toLowerCase() !== 'i') { throw 'I/i problem'; }
/**
* parseCssStylesheet takes a chunk of CSS text and a handler object with
* methods that it calls as below:
* <pre>
* // At the beginning of a stylesheet.
* handler.startStylesheet();
*
* // For an @foo rule ended by a semicolon: @import "foo.css";
* handler.startAtrule('@import', ['"foo.css"']);
* handler.endAtrule();
*
* // For an @foo rule ended with a block. @media print { ... }
* handler.startAtrule('@media', ['print']);
* handler.startBlock();
* // Calls to contents elided. Probably selectors and declarations as below.
* handler.endBlock();
* handler.endAtrule();
*
* // For a ruleset: p.clazz q, s { color: blue; }
* handler.startRuleset(['p', '.', 'clazz', ' ', 'q', ',', ' ', 's']);
* handler.declaration('color', ['blue']);
* handler.endRuleset();
*
* // At the end of a stylesheet.
* handler.endStylesheet();
* </pre>
* When errors are encountered, the parser drops the useless tokens and
* attempts to resume parsing.
*
* @param {string} cssText CSS3 content to parse as a stylesheet.
* @param {Object} handler An object like <pre>{
* startStylesheet: function () { ... },
* endStylesheet: function () { ... },
* startAtrule: function (atIdent, headerArray) { ... },
* endAtrule: function () { ... },
* startBlock: function () { ... },
* endBlock: function () { ... },
* startRuleset: function (selectorArray) { ... },
* endRuleset: function () { ... },
* declaration: function (property, valueArray) { ... },
* }</pre>
*/
var parseCssStylesheet;
/**
* parseCssDeclarations parses a run of declaration productions as seen in the
* body of the HTML5 {@code style} attribute.
*
* @param {string} cssText CSS3 content to parse as a run of declarations.
* @param {Object} handler An object like <pre>{
* declaration: function (property, valueArray) { ... },
* }</pre>
*/
var parseCssDeclarations;
(function () {
// stylesheet : [ CDO | CDC | S | statement ]*;
parseCssStylesheet = function(cssText, handler) {
var toks = lexCss(cssText);
if (handler['startStylesheet']) { handler['startStylesheet'](); }
for (var i = 0, n = toks.length; i < n;) {
// CDO and CDC ("<!--" and "-->") are converted to space by the lexer.
i = toks[i] === ' ' ? i+1 : statement(toks, i, n, handler);
}
if (handler['endStylesheet']) { handler['endStylesheet'](); }
};
// statement : ruleset | at-rule;
function statement(toks, i, n, handler) {
if (i < n) {
var tok = toks[i];
if (tok.charAt(0) === '@') {
return atrule(toks, i, n, handler, true);
} else {
return ruleset(toks, i, n, handler);
}
} else {
return i;
}
}
// at-rule : ATKEYWORD S* any* [ block | ';' S* ];
function atrule(toks, i, n, handler, blockok) {
var start = i++;
while (i < n && toks[i] !== '{' && toks[i] !== ';') {
++i;
}
if (i < n && (blockok || toks[i] === ';')) {
var s = start+1, e = i;
if (s < n && toks[s] === ' ') { ++s; }
if (e > s && toks[e-1] === ' ') { --e; }
if (handler['startAtrule']) {
handler['startAtrule'](toks[start].toLowerCase(), toks.slice(s, e));
}
i = (toks[i] === '{')
? block(toks, i, n, handler)
: i+1; // Skip over ';'
if (handler['endAtrule']) {
handler['endAtrule']();
}
}
// Else we reached end of input or are missing a semicolon.
// Drop the rule on the floor.
return i;
}
// block : '{' S* [ any | block | ATKEYWORD S* | ';' S* ]* '}' S*;
// Assumes the leading '{' has been verified by callers.
function block(toks, i, n, handler) {
++i; // skip over '{'
if (handler['startBlock']) { handler['startBlock'](); }
while (i < n) {
var ch = toks[i].charAt(0);
if (ch == '}') {
++i;
break;
}
if (ch === ' ' || ch === ';') {
i = i+1;
} else if (ch === '@') {
i = atrule(toks, i, n, handler, false);
} else if (ch === '{') {
i = block(toks, i, n, handler);
} else {
// Instead of using (any* block) to subsume ruleset we allow either
// blocks or rulesets with a non-blank selector.
// This is more restrictive but does not require atrule specific
// parse tree fixup to realize that the contents of the block in
// @media print { ... }
// is a ruleset. We just don't care about any block carrying at-rules
// whose body content is not ruleset content.
i = ruleset(toks, i, n, handler);
}
}
if (handler['endBlock']) { handler['endBlock'](); }
return i;
}
// ruleset : selector? '{' S* declaration? [ ';' S* declaration? ]* '}' S*;
function ruleset(toks, i, n, handler) {
// toks[s:e] are the selector tokens including internal whitespace.
var s = i, e = selector(toks, i, n, true);
if (e < 0) {
// Skip malformed content per selector calling convention.
e = ~e;
// Make sure we skip at least one token.
return e === s ? e+1 : e;
}
var tok = toks[e];
if (tok !== '{') {
// Make sure we skip at least one token.
return e === s ? e+1 : e;
}
i = e+1; // Skip over '{'
// Don't include any trailing space in the selector slice.
if (e > s && toks[e-1] === ' ') { --e; }
if (handler['startRuleset']) {
handler['startRuleset'](toks.slice(s, e));
}
while (i < n) {
tok = toks[i];
if (tok === '}') {
++i;
break;
}
if (tok === ' ') {
i = i+1;
} else {
i = declaration(toks, i, n, handler);
}
}
if (handler['endRuleset']) {
handler['endRuleset']();
}
return i;
}
// selector : any+;
// any : [ IDENT | NUMBER | PERCENTAGE | DIMENSION | STRING
// | DELIM | URI | HASH | UNICODE-RANGE | INCLUDES
// | FUNCTION S* any* ')' | DASHMATCH | '(' S* any* ')'
// | '[' S* any* ']' ] S*;
// A negative return value, rv, indicates the selector was malformed and
// the index at which we stopped is ~rv.
function selector(toks, i, n, allowSemi) {
var s = i;
// The definition of any above can be summed up as
// "any run of token except ('[', ']', '(', ')', ':', ';', '{', '}')
// or nested runs of parenthesized tokens or square bracketed tokens".
// Spaces are significant in the selector.
// Selector is used as (selector?) so the below looks for (any*) for
// simplicity.
var tok;
// Keeping a stack pointer actually causes this to minify better since
// ".length" and ".push" are a lo of chars.
var brackets = [], stackLast = -1;
for (;i < n; ++i) {
tok = toks[i].charAt(0);
if (tok === '[' || tok === '(') {
brackets[++stackLast] = tok;
} else if ((tok === ']' && brackets[stackLast] === '[') ||
(tok === ')' && brackets[stackLast] === '(')) {
--stackLast;
} else if (tok === '{' || tok === '}' || tok === ';' || tok === '@'
|| (tok === ':' && !allowSemi)) {
break;
}
}
if (stackLast >= 0) {
// Returns the bitwise inverse of i+1 to indicate an error in the
// token stream so that clients can ignore it.
i = ~(i+1);
}
return i;
}
var ident = /^-?[a-z]/i;
function skipDeclaration(toks, i, n) {
// TODO(felix8a): maybe skip balanced pairs of {}
while (i < n && toks[i] !== ';' && toks[i] !== '}') { ++i; }
return i < n && toks[i] === ';' ? i+1 : i;
}
// declaration : property ':' S* value;
// property : IDENT S*;
// value : [ any | block | ATKEYWORD S* ]+;
function declaration(toks, i, n, handler) {
var property = toks[i++];
if (!ident.test(property)) {
return skipDeclaration(toks, i, n);
}
var tok;
if (i < n && toks[i] === ' ') { ++i; }
if (i == n || toks[i] !== ':') {
return skipDeclaration(toks, i, n);
}
++i;
if (i < n && toks[i] === ' ') { ++i; }
// None of the rules we care about want atrules or blocks in value, so
// we look for any+ but that is the same as selector but not zero-length.
// This gets us the benefit of not emitting any value with mismatched
// brackets.
var s = i, e = selector(toks, i, n, false);
if (e < 0) {
// Skip malformed content per selector calling convention.
e = ~e;
} else {
var value = [], valuelen = 0;
for (var j = s; j < e; ++j) {
tok = toks[j];
if (tok !== ' ') {
value[valuelen++] = tok;
}
}
// One of the following is now true:
// (1) e is flush with the end of the tokens as in <... style="x:y">.
// (2) tok[e] points to a ';' in which case we need to consume the semi.
// (3) tok[e] points to a '}' in which case we don't consume it.
// (4) else there is bogus unparsed value content at toks[e:].
// Allow declaration flush with end for style attr body.
if (e < n) { // 2, 3, or 4
do {
tok = toks[e];
if (tok === ';' || tok === '}') { break; }
// Don't emit the property if there is questionable trailing content.
valuelen = 0;
} while (++e < n);
if (tok === ';') {
++e;
}
}
if (valuelen && handler['declaration']) {
// TODO: coerce non-keyword ident tokens to quoted strings.
handler['declaration'](property.toLowerCase(), value);
}
}
return e;
}
parseCssDeclarations = function(cssText, handler) {
var toks = lexCss(cssText);
for (var i = 0, n = toks.length; i < n;) {
i = toks[i] !== ' ' ? declaration(toks, i, n, handler) : i+1;
}
};
})();
// Exports for closure compiler.
if (typeof window !== 'undefined') {
window['parseCssStylesheet'] = parseCssStylesheet;
window['parseCssDeclarations'] = parseCssDeclarations;
}
;
// Copyright Google Inc.
// Licensed under the Apache Licence Version 2.0
// Autogenerated at Wed Nov 25 17:35:12 CET 2015
// @overrides window
// @provides html4
var html4 = {};
html4.atype = {
'NONE': 0,
'URI': 1,
'URI_FRAGMENT': 11,
'SCRIPT': 2,
'STYLE': 3,
'HTML': 12,
'ID': 4,
'IDREF': 5,
'IDREFS': 6,
'GLOBAL_NAME': 7,
'LOCAL_NAME': 8,
'CLASSES': 9,
'FRAME_TARGET': 10,
'MEDIA_QUERY': 13
};
html4[ 'atype' ] = html4.atype;
html4.ATTRIBS = {
'*::class': 9,
'*::dir': 0,
'*::draggable': 0,
'*::hidden': 0,
'*::id': 4,
'*::inert': 0,
'*::itemprop': 0,
'*::itemref': 6,
'*::itemscope': 0,
'*::lang': 0,
'*::onblur': 2,
'*::onchange': 2,
'*::onclick': 2,
'*::ondblclick': 2,
'*::onerror': 2,
'*::onfocus': 2,
'*::onkeydown': 2,
'*::onkeypress': 2,
'*::onkeyup': 2,
'*::onload': 2,
'*::onmousedown': 2,
'*::onmousemove': 2,
'*::onmouseout': 2,
'*::onmouseover': 2,
'*::onmouseup': 2,
'*::onreset': 2,
'*::onscroll': 2,
'*::onselect': 2,
'*::onsubmit': 2,
'*::ontouchcancel': 2,
'*::ontouchend': 2,
'*::ontouchenter': 2,
'*::ontouchleave': 2,
'*::ontouchmove': 2,
'*::ontouchstart': 2,
'*::onunload': 2,
'*::spellcheck': 0,
'*::style': 3,
'*::tabindex': 0,
'*::title': 0,
'*::translate': 0,
'a::accesskey': 0,
'a::coords': 0,
'a::href': 1,
'a::hreflang': 0,
'a::name': 7,
'a::onblur': 2,
'a::onfocus': 2,
'a::shape': 0,
'a::target': 0,
'a::type': 0,
'area::accesskey': 0,
'area::alt': 0,
'area::coords': 0,
'area::href': 1,
'area::nohref': 0,
'area::onblur': 2,
'area::onfocus': 2,
'area::shape': 0,
'area::target': 10,
'audio::controls': 0,
'audio::loop': 0,
'audio::mediagroup': 5,
'audio::muted': 0,
'audio::preload': 0,
'audio::src': 1,
'bdo::dir': 0,
'blockquote::cite': 1,
'br::clear': 0,
'button::accesskey': 0,
'button::disabled': 0,
'button::name': 8,
'button::onblur': 2,
'button::onfocus': 2,
'button::type': 0,
'button::value': 0,
'canvas::height': 0,
'canvas::width': 0,
'caption::align': 0,
'col::align': 0,
'col::char': 0,
'col::charoff': 0,
'col::span': 0,
'col::valign': 0,
'col::width': 0,
'colgroup::align': 0,
'colgroup::char': 0,
'colgroup::charoff': 0,
'colgroup::span': 0,
'colgroup::valign': 0,
'colgroup::width': 0,
'command::checked': 0,
'command::command': 5,
'command::disabled': 0,
'command::icon': 1,
'command::label': 0,
'command::radiogroup': 0,
'command::type': 0,
'data::value': 0,
'del::cite': 1,
'del::datetime': 0,
'details::open': 0,
'dir::compact': 0,
'div::align': 0,
'dl::compact': 0,
'fieldset::disabled': 0,
'font::color': 0,
'font::face': 0,
'font::size': 0,
'form::accept': 0,
'form::action': 1,
'form::autocomplete': 0,
'form::enctype': 0,
'form::method': 0,
'form::name': 7,
'form::novalidate': 0,
'form::onreset': 2,
'form::onsubmit': 2,
'form::target': 10,
'h1::align': 0,
'h2::align': 0,
'h3::align': 0,
'h4::align': 0,
'h5::align': 0,
'h6::align': 0,
'hr::align': 0,
'hr::noshade': 0,
'hr::size': 0,
'hr::width': 0,
'iframe::align': 0,
'iframe::frameborder': 0,
'iframe::height': 0,
'iframe::marginheight': 0,
'iframe::marginwidth': 0,
'iframe::width': 0,
'img::align': 0,
'img::alt': 0,
'img::border': 0,
'img::height': 0,
'img::hspace': 0,
'img::ismap': 0,
'img::name': 7,
'img::src': 1,
'img::usemap': 11,
'img::vspace': 0,
'img::width': 0,
'input::accept': 0,
'input::accesskey': 0,
'input::align': 0,
'input::alt': 0,
'input::autocomplete': 0,
'input::checked': 0,
'input::disabled': 0,
'input::inputmode': 0,
'input::ismap': 0,
'input::list': 5,
'input::max': 0,
'input::maxlength': 0,
'input::min': 0,
'input::multiple': 0,
'input::name': 8,
'input::onblur': 2,
'input::onchange': 2,
'input::onfocus': 2,
'input::onselect': 2,
'input::pattern': 0,
'input::placeholder': 0,
'input::readonly': 0,
'input::required': 0,
'input::size': 0,
'input::src': 1,
'input::step': 0,
'input::type': 0,
'input::usemap': 11,
'input::value': 0,
'ins::cite': 1,
'ins::datetime': 0,
'label::accesskey': 0,
'label::for': 5,
'label::onblur': 2,
'label::onfocus': 2,
'legend::accesskey': 0,
'legend::align': 0,
'li::type': 0,
'li::value': 0,
'map::name': 7,
'menu::compact': 0,
'menu::label': 0,
'menu::type': 0,
'meter::high': 0,
'meter::low': 0,
'meter::max': 0,
'meter::min': 0,
'meter::optimum': 0,
'meter::value': 0,
'ol::compact': 0,
'ol::reversed': 0,
'ol::start': 0,
'ol::type': 0,
'optgroup::disabled': 0,
'optgroup::label': 0,
'option::disabled': 0,
'option::label': 0,
'option::selected': 0,
'option::value': 0,
'output::for': 6,
'output::name': 8,
'p::align': 0,
'pre::width': 0,
'progress::max': 0,
'progress::min': 0,
'progress::value': 0,
'q::cite': 1,
'select::autocomplete': 0,
'select::disabled': 0,
'select::multiple': 0,
'select::name': 8,
'select::onblur': 2,
'select::onchange': 2,
'select::onfocus': 2,
'select::required': 0,
'select::size': 0,
'source::type': 0,
'table::align': 0,
'table::bgcolor': 0,
'table::border': 0,
'table::cellpadding': 0,
'table::cellspacing': 0,
'table::frame': 0,
'table::rules': 0,
'table::summary': 0,
'table::width': 0,
'tbody::align': 0,
'tbody::char': 0,
'tbody::charoff': 0,
'tbody::valign': 0,
'td::abbr': 0,
'td::align': 0,
'td::axis': 0,
'td::bgcolor': 0,
'td::char': 0,
'td::charoff': 0,
'td::colspan': 0,
'td::headers': 6,
'td::height': 0,
'td::nowrap': 0,
'td::rowspan': 0,
'td::scope': 0,
'td::valign': 0,
'td::width': 0,
'textarea::accesskey': 0,
'textarea::autocomplete': 0,
'textarea::cols': 0,
'textarea::disabled': 0,
'textarea::inputmode': 0,
'textarea::name': 8,
'textarea::onblur': 2,
'textarea::onchange': 2,
'textarea::onfocus': 2,
'textarea::onselect': 2,
'textarea::placeholder': 0,
'textarea::readonly': 0,
'textarea::required': 0,
'textarea::rows': 0,
'textarea::wrap': 0,
'tfoot::align': 0,
'tfoot::char': 0,
'tfoot::charoff': 0,
'tfoot::valign': 0,
'th::abbr': 0,
'th::align': 0,
'th::axis': 0,
'th::bgcolor': 0,
'th::char': 0,
'th::charoff': 0,
'th::colspan': 0,
'th::headers': 6,
'th::height': 0,
'th::nowrap': 0,
'th::rowspan': 0,
'th::scope': 0,
'th::valign': 0,
'th::width': 0,
'thead::align': 0,
'thead::char': 0,
'thead::charoff': 0,
'thead::valign': 0,
'tr::align': 0,
'tr::bgcolor': 0,
'tr::char': 0,
'tr::charoff': 0,
'tr::valign': 0,
'track::default': 0,
'track::kind': 0,
'track::label': 0,
'track::srclang': 0,
'ul::compact': 0,
'ul::type': 0,
'video::controls': 0,
'video::height': 0,
'video::loop': 0,
'video::mediagroup': 5,
'video::muted': 0,
'video::poster': 1,
'video::preload': 0,
'video::src': 1,
'video::width': 0
};
html4[ 'ATTRIBS' ] = html4.ATTRIBS;
html4.eflags = {
'OPTIONAL_ENDTAG': 1,
'EMPTY': 2,
'CDATA': 4,
'RCDATA': 8,
'UNSAFE': 16,
'FOLDABLE': 32,
'SCRIPT': 64,
'STYLE': 128,
'VIRTUALIZED': 256
};
html4[ 'eflags' ] = html4.eflags;
html4.ELEMENTS = {
'a': 0,
'abbr': 0,
'acronym': 0,
'address': 0,
'applet': 272,
'area': 2,
'article': 0,
'aside': 0,
'audio': 0,
'b': 0,
'base': 274,
'basefont': 274,
'bdi': 0,
'bdo': 0,
'big': 0,
'blockquote': 0,
'body': 305,
'br': 2,
'button': 0,
'canvas': 0,
'caption': 0,
'center': 0,
'cite': 0,
'code': 0,
'col': 2,
'colgroup': 1,
'command': 2,
'data': 0,
'datalist': 0,
'dd': 1,
'del': 0,
'details': 0,
'dfn': 0,
'dialog': 272,
'dir': 0,
'div': 0,
'dl': 0,
'dt': 1,
'em': 0,
'fieldset': 0,
'figcaption': 0,
'figure': 0,
'font': 0,
'footer': 0,
'form': 0,
'frame': 274,
'frameset': 272,
'h1': 0,
'h2': 0,
'h3': 0,
'h4': 0,
'h5': 0,
'h6': 0,
'head': 305,
'header': 0,
'hgroup': 0,
'hr': 2,
'html': 305,
'i': 0,
'iframe': 16,
'img': 2,
'input': 2,
'ins': 0,
'isindex': 274,
'kbd': 0,
'keygen': 274,
'label': 0,
'legend': 0,
'li': 1,
'link': 274,
'map': 0,
'mark': 0,
'menu': 0,
'meta': 274,
'meter': 0,
'nav': 0,
'nobr': 0,
'noembed': 276,
'noframes': 276,
'noscript': 276,
'object': 272,
'ol': 0,
'optgroup': 0,
'option': 1,
'output': 0,
'p': 1,
'param': 274,
'pre': 0,
'progress': 0,
'q': 0,
's': 0,
'samp': 0,
'script': 84,
'section': 0,
'select': 0,
'small': 0,
'source': 2,
'span': 0,
'strike': 0,
'strong': 0,
'style': 148,
'sub': 0,
'summary': 0,
'sup': 0,
'table': 0,
'tbody': 1,
'td': 1,
'textarea': 8,
'tfoot': 1,
'th': 1,
'thead': 1,
'time': 0,
'title': 280,
'tr': 1,
'track': 2,
'tt': 0,
'u': 0,
'ul': 0,
'var': 0,
'video': 0,
'wbr': 2
};
html4[ 'ELEMENTS' ] = html4.ELEMENTS;
html4.ELEMENT_DOM_INTERFACES = {
'a': 'HTMLAnchorElement',
'abbr': 'HTMLElement',
'acronym': 'HTMLElement',
'address': 'HTMLElement',
'applet': 'HTMLAppletElement',
'area': 'HTMLAreaElement',
'article': 'HTMLElement',
'aside': 'HTMLElement',
'audio': 'HTMLAudioElement',
'b': 'HTMLElement',
'base': 'HTMLBaseElement',
'basefont': 'HTMLBaseFontElement',
'bdi': 'HTMLElement',
'bdo': 'HTMLElement',
'big': 'HTMLElement',
'blockquote': 'HTMLQuoteElement',
'body': 'HTMLBodyElement',
'br': 'HTMLBRElement',
'button': 'HTMLButtonElement',
'canvas': 'HTMLCanvasElement',
'caption': 'HTMLTableCaptionElement',
'center': 'HTMLElement',
'cite': 'HTMLElement',
'code': 'HTMLElement',
'col': 'HTMLTableColElement',
'colgroup': 'HTMLTableColElement',
'command': 'HTMLCommandElement',
'data': 'HTMLElement',
'datalist': 'HTMLDataListElement',
'dd': 'HTMLElement',
'del': 'HTMLModElement',
'details': 'HTMLDetailsElement',
'dfn': 'HTMLElement',
'dialog': 'HTMLDialogElement',
'dir': 'HTMLDirectoryElement',
'div': 'HTMLDivElement',
'dl': 'HTMLDListElement',
'dt': 'HTMLElement',
'em': 'HTMLElement',
'fieldset': 'HTMLFieldSetElement',
'figcaption': 'HTMLElement',
'figure': 'HTMLElement',
'font': 'HTMLFontElement',
'footer': 'HTMLElement',
'form': 'HTMLFormElement',
'frame': 'HTMLFrameElement',
'frameset': 'HTMLFrameSetElement',
'h1': 'HTMLHeadingElement',
'h2': 'HTMLHeadingElement',
'h3': 'HTMLHeadingElement',
'h4': 'HTMLHeadingElement',
'h5': 'HTMLHeadingElement',
'h6': 'HTMLHeadingElement',
'head': 'HTMLHeadElement',
'header': 'HTMLElement',
'hgroup': 'HTMLElement',
'hr': 'HTMLHRElement',
'html': 'HTMLHtmlElement',
'i': 'HTMLElement',
'iframe': 'HTMLIFrameElement',
'img': 'HTMLImageElement',
'input': 'HTMLInputElement',
'ins': 'HTMLModElement',
'isindex': 'HTMLUnknownElement',
'kbd': 'HTMLElement',
'keygen': 'HTMLKeygenElement',
'label': 'HTMLLabelElement',
'legend': 'HTMLLegendElement',
'li': 'HTMLLIElement',
'link': 'HTMLLinkElement',
'map': 'HTMLMapElement',
'mark': 'HTMLElement',
'menu': 'HTMLMenuElement',
'meta': 'HTMLMetaElement',
'meter': 'HTMLMeterElement',
'nav': 'HTMLElement',
'nobr': 'HTMLElement',
'noembed': 'HTMLElement',
'noframes': 'HTMLElement',
'noscript': 'HTMLElement',
'object': 'HTMLObjectElement',
'ol': 'HTMLOListElement',
'optgroup': 'HTMLOptGroupElement',
'option': 'HTMLOptionElement',
'output': 'HTMLOutputElement',
'p': 'HTMLParagraphElement',
'param': 'HTMLParamElement',
'pre': 'HTMLPreElement',
'progress': 'HTMLProgressElement',
'q': 'HTMLQuoteElement',
's': 'HTMLElement',
'samp': 'HTMLElement',
'script': 'HTMLScriptElement',
'section': 'HTMLElement',
'select': 'HTMLSelectElement',
'small': 'HTMLElement',
'source': 'HTMLSourceElement',
'span': 'HTMLSpanElement',
'strike': 'HTMLElement',
'strong': 'HTMLElement',
'style': 'HTMLStyleElement',
'sub': 'HTMLElement',
'summary': 'HTMLElement',
'sup': 'HTMLElement',
'table': 'HTMLTableElement',
'tbody': 'HTMLTableSectionElement',
'td': 'HTMLTableDataCellElement',
'textarea': 'HTMLTextAreaElement',
'tfoot': 'HTMLTableSectionElement',
'th': 'HTMLTableHeaderCellElement',
'thead': 'HTMLTableSectionElement',
'time': 'HTMLTimeElement',
'title': 'HTMLTitleElement',
'tr': 'HTMLTableRowElement',
'track': 'HTMLTrackElement',
'tt': 'HTMLElement',
'u': 'HTMLElement',
'ul': 'HTMLUListElement',
'var': 'HTMLElement',
'video': 'HTMLVideoElement',
'wbr': 'HTMLElement'
};
html4[ 'ELEMENT_DOM_INTERFACES' ] = html4.ELEMENT_DOM_INTERFACES;
html4.ueffects = {
'NOT_LOADED': 0,
'SAME_DOCUMENT': 1,
'NEW_DOCUMENT': 2
};
html4[ 'ueffects' ] = html4.ueffects;
html4.URIEFFECTS = {
'a::href': 2,
'area::href': 2,
'audio::src': 1,
'blockquote::cite': 0,
'command::icon': 1,
'del::cite': 0,
'form::action': 2,
'img::src': 1,
'input::src': 1,
'ins::cite': 0,
'q::cite': 0,
'video::poster': 1,
'video::src': 1
};
html4[ 'URIEFFECTS' ] = html4.URIEFFECTS;
html4.ltypes = {
'UNSANDBOXED': 2,
'SANDBOXED': 1,
'DATA': 0
};
html4[ 'ltypes' ] = html4.ltypes;
html4.LOADERTYPES = {
'a::href': 2,
'area::href': 2,
'audio::src': 2,
'blockquote::cite': 2,
'command::icon': 1,
'del::cite': 2,
'form::action': 2,
'img::src': 1,
'input::src': 1,
'ins::cite': 2,
'q::cite': 2,
'video::poster': 1,
'video::src': 2
};
html4[ 'LOADERTYPES' ] = html4.LOADERTYPES;
// export for Closure Compiler
if (typeof window !== 'undefined') {
window['html4'] = html4;
}
;
// Copyright (C) 2006 Google Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/**
* @fileoverview
* An HTML sanitizer that can satisfy a variety of security policies.
*
* <p>
* The HTML sanitizer is built around a SAX parser and HTML element and
* attributes schemas.
*
* If the cssparser is loaded, inline styles are sanitized using the
* css property and value schemas. Else they are remove during
* sanitization.
*
* If it exists, uses parseCssDeclarations, sanitizeCssProperty, cssSchema
*
* @author mikesamuel@gmail.com
* @author jasvir@gmail.com
* \@requires html4, URI
* \@overrides window
* \@provides html, html_sanitize
*/
// The Turkish i seems to be a non-issue, but abort in case it is.
if ('I'.toLowerCase() !== 'i') { throw 'I/i problem'; }
/**
* \@namespace
*/
var html = (function(html4) {
// For closure compiler
var parseCssDeclarations, sanitizeCssProperty, cssSchema;
if ('undefined' !== typeof window) {
parseCssDeclarations = window['parseCssDeclarations'];
sanitizeCssProperty = window['sanitizeCssProperty'];
cssSchema = window['cssSchema'];
}
// The keys of this object must be 'quoted' or JSCompiler will mangle them!
// This is a partial list -- lookupEntity() uses the host browser's parser
// (when available) to implement full entity lookup.
// Note that entities are in general case-sensitive; the uppercase ones are
// explicitly defined by HTML5 (presumably as compatibility).
var ENTITIES = {
'lt': '<',
'LT': '<',
'gt': '>',
'GT': '>',
'amp': '&',
'AMP': '&',
'quot': '"',
'apos': '\'',
'nbsp': '\240'
};
// Patterns for types of entity/character reference names.
var decimalEscapeRe = /^#(\d+)$/;
var hexEscapeRe = /^#x([0-9A-Fa-f]+)$/;
// contains every entity per http://www.w3.org/TR/2011/WD-html5-20110113/named-character-references.html
var safeEntityNameRe = /^[A-Za-z][A-za-z0-9]+$/;
// Used as a hook to invoke the browser's entity parsing. <textarea> is used
// because its content is parsed for entities but not tags.
// TODO(kpreid): This retrieval is a kludge and leads to silent loss of
// functionality if the document isn't available.
var entityLookupElement =
('undefined' !== typeof window && window['document'])
? window['document'].createElement('textarea') : null;
/**
* Decodes an HTML entity.
*
* {\@updoc
* $ lookupEntity('lt')
* # '<'
* $ lookupEntity('GT')
* # '>'
* $ lookupEntity('amp')
* # '&'
* $ lookupEntity('nbsp')
* # '\xA0'
* $ lookupEntity('apos')
* # "'"
* $ lookupEntity('quot')
* # '"'
* $ lookupEntity('#xa')
* # '\n'
* $ lookupEntity('#10')
* # '\n'
* $ lookupEntity('#x0a')
* # '\n'
* $ lookupEntity('#010')
* # '\n'
* $ lookupEntity('#x00A')
* # '\n'
* $ lookupEntity('Pi') // Known failure
* # '\u03A0'
* $ lookupEntity('pi') // Known failure
* # '\u03C0'
* }
*
* @param {string} name the content between the '&' and the ';'.
* @return {string} a single unicode code-point as a string.
*/
function lookupEntity(name) {
// TODO: entity lookup as specified by HTML5 actually depends on the
// presence of the ";".
if (ENTITIES.hasOwnProperty(name)) { return ENTITIES[name]; }
var m = name.match(decimalEscapeRe);
if (m) {
return String.fromCharCode(parseInt(m[1], 10));
} else if (!!(m = name.match(hexEscapeRe))) {
return String.fromCharCode(parseInt(m[1], 16));
} else if (entityLookupElement && safeEntityNameRe.test(name)) {
entityLookupElement.innerHTML = '&' + name + ';';
var text = entityLookupElement.textContent;
ENTITIES[name] = text;
return text;
} else {
return '&' + name + ';';
}
}
function decodeOneEntity(_, name) {
return lookupEntity(name);
}
var nulRe = /\0/g;
function stripNULs(s) {
return s.replace(nulRe, '');
}
var ENTITY_RE_1 = /&(#[0-9]+|#[xX][0-9A-Fa-f]+|\w+);/g;
var ENTITY_RE_2 = /^(#[0-9]+|#[xX][0-9A-Fa-f]+|\w+);/;
/**
* The plain text of a chunk of HTML CDATA which possibly containing.
*
* {\@updoc
* $ unescapeEntities('')
* # ''
* $ unescapeEntities('hello World!')
* # 'hello World!'
* $ unescapeEntities('1 &lt; 2 &amp;&AMP; 4 &gt; 3&#10;')
* # '1 < 2 && 4 > 3\n'
* $ unescapeEntities('&lt;&lt <- unfinished entity&gt;')
* # '<&lt <- unfinished entity>'
* $ unescapeEntities('/foo?bar=baz&copy=true') // & often unescaped in URLS
* # '/foo?bar=baz&copy=true'
* $ unescapeEntities('pi=&pi;&#x3c0;, Pi=&Pi;\u03A0') // FIXME: known failure
* # 'pi=\u03C0\u03c0, Pi=\u03A0\u03A0'
* }
*
* @param {string} s a chunk of HTML CDATA. It must not start or end inside
* an HTML entity.
*/
function unescapeEntities(s) {
return s.replace(ENTITY_RE_1, decodeOneEntity);
}
var ampRe = /&/g;
var looseAmpRe = /&([^a-z#]|#(?:[^0-9x]|x(?:[^0-9a-f]|$)|$)|$)/gi;
var ltRe = /[<]/g;
var gtRe = />/g;
var quotRe = /\"/g;
/**
* Escapes HTML special characters in attribute values.
*
* {\@updoc
* $ escapeAttrib('')
* # ''
* $ escapeAttrib('"<<&==&>>"') // Do not just escape the first occurrence.
* # '&#34;&lt;&lt;&amp;&#61;&#61;&amp;&gt;&gt;&#34;'
* $ escapeAttrib('Hello <World>!')
* # 'Hello &lt;World&gt;!'
* }
*/
function escapeAttrib(s) {
return ('' + s).replace(ampRe, '&amp;').replace(ltRe, '&lt;')
.replace(gtRe, '&gt;').replace(quotRe, '&#34;');
}
/**
* Escape entities in RCDATA that can be escaped without changing the meaning.
* {\@updoc
* $ normalizeRCData('1 < 2 &&amp; 3 > 4 &amp;& 5 &lt; 7&8')
* # '1 &lt; 2 &amp;&amp; 3 &gt; 4 &amp;&amp; 5 &lt; 7&amp;8'
* }
*/
function normalizeRCData(rcdata) {
return rcdata
.replace(looseAmpRe, '&amp;$1')
.replace(ltRe, '&lt;')
.replace(gtRe, '&gt;');
}
// TODO(felix8a): validate sanitizer regexs against the HTML5 grammar at
// http://www.whatwg.org/specs/web-apps/current-work/multipage/syntax.html
// http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html
// http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html
// http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html
// We initially split input so that potentially meaningful characters
// like '<' and '>' are separate tokens, using a fast dumb process that
// ignores quoting. Then we walk that token stream, and when we see a
// '<' that's the start of a tag, we use ATTR_RE to extract tag
// attributes from the next token. That token will never have a '>'
// character. However, it might have an unbalanced quote character, and
// when we see that, we combine additional tokens to balance the quote.
var ATTR_RE = new RegExp(
'^\\s*' +
'([-.:\\w]+)' + // 1 = Attribute name
'(?:' + (
'\\s*(=)\\s*' + // 2 = Is there a value?
'(' + ( // 3 = Attribute value
// TODO(felix8a): maybe use backref to match quotes
'(\")[^\"]*(\"|$)' + // 4, 5 = Double-quoted string
'|' +
'(\')[^\']*(\'|$)' + // 6, 7 = Single-quoted string
'|' +
// Positive lookahead to prevent interpretation of
// <foo a= b=c> as <foo a='b=c'>
// TODO(felix8a): might be able to drop this case
'(?=[a-z][-\\w]*\\s*=)' +
'|' +
// Unquoted value that isn't an attribute name
// (since we didn't match the positive lookahead above)
'[^\"\'\\s]*' ) +
')' ) +
')?',
'i');
// false on IE<=8, true on most other browsers
var splitWillCapture = ('a,b'.split(/(,)/).length === 3);
// bitmask for tags with special parsing, like <script> and <textarea>
var EFLAGS_TEXT = html4.eflags['CDATA'] | html4.eflags['RCDATA'];
/**
* Given a SAX-like event handler, produce a function that feeds those
* events and a parameter to the event handler.
*
* The event handler has the form:{@code
* {
* // Name is an upper-case HTML tag name. Attribs is an array of
* // alternating upper-case attribute names, and attribute values. The
* // attribs array is reused by the parser. Param is the value passed to
* // the saxParser.
* startTag: function (name, attribs, param) { ... },
* endTag: function (name, param) { ... },
* pcdata: function (text, param) { ... },
* rcdata: function (text, param) { ... },
* cdata: function (text, param) { ... },
* startDoc: function (param) { ... },
* endDoc: function (param) { ... }
* }}
*
* @param {Object} handler a record containing event handlers.
* @return {function(string, Object)} A function that takes a chunk of HTML
* and a parameter. The parameter is passed on to the handler methods.
*/
function makeSaxParser(handler) {
// Accept quoted or unquoted keys (Closure compat)
var hcopy = {
cdata: handler.cdata || handler['cdata'],
comment: handler.comment || handler['comment'],
endDoc: handler.endDoc || handler['endDoc'],
endTag: handler.endTag || handler['endTag'],
pcdata: handler.pcdata || handler['pcdata'],
rcdata: handler.rcdata || handler['rcdata'],
startDoc: handler.startDoc || handler['startDoc'],
startTag: handler.startTag || handler['startTag']
};
return function(htmlText, param) {
return parse(htmlText, hcopy, param);
};
}
// Parsing strategy is to split input into parts that might be lexically
// meaningful (every ">" becomes a separate part), and then recombine
// parts if we discover they're in a different context.
// TODO(felix8a): Significant performance regressions from -legacy,
// tested on
// Chrome 18.0
// Firefox 11.0
// IE 6, 7, 8, 9
// Opera 11.61
// Safari 5.1.3
// Many of these are unusual patterns that are linearly slower and still
// pretty fast (eg 1ms to 5ms), so not necessarily worth fixing.
// TODO(felix8a): "<script> && && && ... <\/script>" is slower on all
// browsers. The hotspot is htmlSplit.
// TODO(felix8a): "<p title='>>>>...'><\/p>" is slower on all browsers.
// This is partly htmlSplit, but the hotspot is parseTagAndAttrs.
// TODO(felix8a): "<a><\/a><a><\/a>..." is slower on IE9.
// "<a>1<\/a><a>1<\/a>..." is faster, "<a><\/a>2<a><\/a>2..." is faster.
// TODO(felix8a): "<p<p<p..." is slower on IE[6-8]
var continuationMarker = {};
function parse(htmlText, handler, param) {
var m, p, tagName;
var parts = htmlSplit(htmlText);
var state = {
noMoreGT: false,
noMoreEndComments: false
};
parseCPS(handler, parts, 0, state, param);
}
function continuationMaker(h, parts, initial, state, param) {
return function () {
parseCPS(h, parts, initial, state, param);
};
}
function parseCPS(h, parts, initial, state, param) {
try {
if (h.startDoc && initial == 0) { h.startDoc(param); }
var m, p, tagName;
for (var pos = initial, end = parts.length; pos < end;) {
var current = parts[pos++];
var next = parts[pos];
switch (current) {
case '&':
if (ENTITY_RE_2.test(next)) {
if (h.pcdata) {
h.pcdata('&' + next, param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
pos++;
} else {
if (h.pcdata) { h.pcdata("&amp;", param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
}
break;
case '<\/':
if ((m = /^([-\w:]+)[^\'\"]*/.exec(next))) {
if (m[0].length === next.length && parts[pos + 1] === '>') {
// fast case, no attribute parsing needed
pos += 2;
tagName = m[1].toLowerCase();
if (h.endTag) {
h.endTag(tagName, param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
} else {
// slow case, need to parse attributes
// TODO(felix8a): do we really care about misparsing this?
pos = parseEndTag(
parts, pos, h, param, continuationMarker, state);
}
} else {
if (h.pcdata) {
h.pcdata('&lt;/', param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
}
break;
case '<':
if (m = /^([-\w:]+)\s*\/?/.exec(next)) {
if (m[0].length === next.length && parts[pos + 1] === '>') {
// fast case, no attribute parsing needed
pos += 2;
tagName = m[1].toLowerCase();
if (h.startTag) {
h.startTag(tagName, [], param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
// tags like <script> and <textarea> have special parsing
var eflags = html4.ELEMENTS[tagName];
if (eflags & EFLAGS_TEXT) {
var tag = { name: tagName, next: pos, eflags: eflags };
pos = parseText(
parts, tag, h, param, continuationMarker, state);
}
} else {
// slow case, need to parse attributes
pos = parseStartTag(
parts, pos, h, param, continuationMarker, state);
}
} else {
if (h.pcdata) {
h.pcdata('&lt;', param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
}
break;
case '<\!--':
// The pathological case is n copies of '<\!--' without '-->', and
// repeated failure to find '-->' is quadratic. We avoid that by
// remembering when search for '-->' fails.
if (!state.noMoreEndComments) {
// A comment <\!--x--> is split into three tokens:
// '<\!--', 'x--', '>'
// We want to find the next '>' token that has a preceding '--'.
// pos is at the 'x--'.
for (p = pos + 1; p < end; p++) {
if (parts[p] === '>' && /--$/.test(parts[p - 1])) { break; }
}
if (p < end) {
if (h.comment) {
var comment = parts.slice(pos, p).join('');
h.comment(
comment.substr(0, comment.length - 2), param,
continuationMarker,
continuationMaker(h, parts, p + 1, state, param));
}
pos = p + 1;
} else {
state.noMoreEndComments = true;
}
}
if (state.noMoreEndComments) {
if (h.pcdata) {
h.pcdata('&lt;!--', param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
}
break;
case '<\!':
if (!/^\w/.test(next)) {
if (h.pcdata) {
h.pcdata('&lt;!', param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
} else {
// similar to noMoreEndComment logic
if (!state.noMoreGT) {
for (p = pos + 1; p < end; p++) {
if (parts[p] === '>') { break; }
}
if (p < end) {
pos = p + 1;
} else {
state.noMoreGT = true;
}
}
if (state.noMoreGT) {
if (h.pcdata) {
h.pcdata('&lt;!', param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
}
}
break;
case '<?':
// similar to noMoreEndComment logic
if (!state.noMoreGT) {
for (p = pos + 1; p < end; p++) {
if (parts[p] === '>') { break; }
}
if (p < end) {
pos = p + 1;
} else {
state.noMoreGT = true;
}
}
if (state.noMoreGT) {
if (h.pcdata) {
h.pcdata('&lt;?', param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
}
break;
case '>':
if (h.pcdata) {
h.pcdata("&gt;", param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
break;
case '':
break;
default:
if (h.pcdata) {
h.pcdata(current, param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
break;
}
}
if (h.endDoc) { h.endDoc(param); }
} catch (e) {
if (e !== continuationMarker) { throw e; }
}
}
// Split str into parts for the html parser.
function htmlSplit(str) {
// can't hoist this out of the function because of the re.exec loop.
var re = /(<\/|<\!--|<[!?]|[&<>])/g;
str += '';
if (splitWillCapture) {
return str.split(re);
} else {
var parts = [];
var lastPos = 0;
var m;
while ((m = re.exec(str)) !== null) {
parts.push(str.substring(lastPos, m.index));
parts.push(m[0]);
lastPos = m.index + m[0].length;
}
parts.push(str.substring(lastPos));
return parts;
}
}
function parseEndTag(parts, pos, h, param, continuationMarker, state) {
var tag = parseTagAndAttrs(parts, pos);
// drop unclosed tags
if (!tag) { return parts.length; }
if (h.endTag) {
h.endTag(tag.name, param, continuationMarker,
continuationMaker(h, parts, pos, state, param));
}
return tag.next;
}
function parseStartTag(parts, pos, h, param, continuationMarker, state) {
var tag = parseTagAndAttrs(parts, pos);
// drop unclosed tags
if (!tag) { return parts.length; }
if (h.startTag) {
h.startTag(tag.name, tag.attrs, param, continuationMarker,
continuationMaker(h, parts, tag.next, state, param));
}
// tags like <script> and <textarea> have special parsing
if (tag.eflags & EFLAGS_TEXT) {
return parseText(parts, tag, h, param, continuationMarker, state);
} else {
return tag.next;
}
}
var endTagRe = {};
// Tags like <script> and <textarea> are flagged as CDATA or RCDATA,
// which means everything is text until we see the correct closing tag.
function parseText(parts, tag, h, param, continuationMarker, state) {
var end = parts.length;
if (!endTagRe.hasOwnProperty(tag.name)) {
endTagRe[tag.name] = new RegExp('^' + tag.name + '(?:[\\s\\/]|$)', 'i');
}
var re = endTagRe[tag.name];
var first = tag.next;
var p = tag.next + 1;
for (; p < end; p++) {
if (parts[p - 1] === '<\/' && re.test(parts[p])) { break; }
}
if (p < end) { p -= 1; }
var buf = parts.slice(first, p).join('');
if (tag.eflags & html4.eflags['CDATA']) {
if (h.cdata) {
h.cdata(buf, param, continuationMarker,
continuationMaker(h, parts, p, state, param));
}
} else if (tag.eflags & html4.eflags['RCDATA']) {
if (h.rcdata) {
h.rcdata(normalizeRCData(buf), param, continuationMarker,
continuationMaker(h, parts, p, state, param));
}
} else {
throw new Error('bug');
}
return p;
}
// at this point, parts[pos-1] is either "<" or "<\/".
function parseTagAndAttrs(parts, pos) {
var m = /^([-\w:]+)/.exec(parts[pos]);
var tag = {};
tag.name = m[1].toLowerCase();
tag.eflags = html4.ELEMENTS[tag.name];
var buf = parts[pos].substr(m[0].length);
// Find the next '>'. We optimistically assume this '>' is not in a
// quoted context, and further down we fix things up if it turns out to
// be quoted.
var p = pos + 1;
var end = parts.length;
for (; p < end; p++) {
if (parts[p] === '>') { break; }
buf += parts[p];
}
if (end <= p) { return void 0; }
var attrs = [];
while (buf !== '') {
m = ATTR_RE.exec(buf);
if (!m) {
// No attribute found: skip garbage
buf = buf.replace(/^[\s\S][^a-z\s]*/, '');
} else if ((m[4] && !m[5]) || (m[6] && !m[7])) {
// Unterminated quote: slurp to the next unquoted '>'
var quote = m[4] || m[6];
var sawQuote = false;
var abuf = [buf, parts[p++]];
for (; p < end; p++) {
if (sawQuote) {
if (parts[p] === '>') { break; }
} else if (0 <= parts[p].indexOf(quote)) {
sawQuote = true;
}
abuf.push(parts[p]);
}
// Slurp failed: lose the garbage
if (end <= p) { break; }
// Otherwise retry attribute parsing
buf = abuf.join('');
continue;
} else {
// We have an attribute
var aName = m[1].toLowerCase();
var aValue = m[2] ? decodeValue(m[3]) : '';
attrs.push(aName, aValue);
buf = buf.substr(m[0].length);
}
}
tag.attrs = attrs;
tag.next = p + 1;
return tag;
}
function decodeValue(v) {
var q = v.charCodeAt(0);
if (q === 0x22 || q === 0x27) { // " or '
v = v.substr(1, v.length - 2);
}
return unescapeEntities(stripNULs(v));
}
/**
* Returns a function that strips unsafe tags and attributes from html.
* @param {function(string, Array.<string>): ?Array.<string>} tagPolicy
* A function that takes (tagName, attribs[]), where tagName is a key in
* html4.ELEMENTS and attribs is an array of alternating attribute names
* and values. It should return a record (as follows), or null to delete
* the element. It's okay for tagPolicy to modify the attribs array,
* but the same array is reused, so it should not be held between calls.
* Record keys:
* attribs: (required) Sanitized attributes array.
* tagName: Replacement tag name.
* @return {function(string, Array)} A function that sanitizes a string of
* HTML and appends result strings to the second argument, an array.
*/
function makeHtmlSanitizer(tagPolicy) {
var stack;
var ignoring;
var emit = function (text, out) {
if (!ignoring) { out.push(text); }
};
return makeSaxParser({
'startDoc': function(_) {
stack = [];
ignoring = false;
},
'startTag': function(tagNameOrig, attribs, out) {
if (ignoring) { return; }
if (!html4.ELEMENTS.hasOwnProperty(tagNameOrig)) { return; }
var eflagsOrig = html4.ELEMENTS[tagNameOrig];
if (eflagsOrig & html4.eflags['FOLDABLE']) {
return;
}
var decision = tagPolicy(tagNameOrig, attribs);
if (!decision) {
ignoring = !(eflagsOrig & html4.eflags['EMPTY']);
return;
} else if (typeof decision !== 'object') {
throw new Error('tagPolicy did not return object (old API?)');
}
if ('attribs' in decision) {
attribs = decision['attribs'];
} else {
throw new Error('tagPolicy gave no attribs');
}
var eflagsRep;
var tagNameRep;
if ('tagName' in decision) {
tagNameRep = decision['tagName'];
eflagsRep = html4.ELEMENTS[tagNameRep];
} else {
tagNameRep = tagNameOrig;
eflagsRep = eflagsOrig;
}
// TODO(mikesamuel): relying on tagPolicy not to insert unsafe
// attribute names.
// If this is an optional-end-tag element and either this element or its
// previous like sibling was rewritten, then insert a close tag to
// preserve structure.
if (eflagsOrig & html4.eflags['OPTIONAL_ENDTAG']) {
var onStack = stack[stack.length - 1];
if (onStack && onStack.orig === tagNameOrig &&
(onStack.rep !== tagNameRep || tagNameOrig !== tagNameRep)) {
out.push('<\/', onStack.rep, '>');
}
}
if (!(eflagsOrig & html4.eflags['EMPTY'])) {
stack.push({orig: tagNameOrig, rep: tagNameRep});
}
out.push('<', tagNameRep);
for (var i = 0, n = attribs.length; i < n; i += 2) {
var attribName = attribs[i],
value = attribs[i + 1];
if (value !== null && value !== void 0) {
out.push(' ', attribName, '="', escapeAttrib(value), '"');
}
}
out.push('>');
if ((eflagsOrig & html4.eflags['EMPTY'])
&& !(eflagsRep & html4.eflags['EMPTY'])) {
// replacement is non-empty, synthesize end tag
out.push('<\/', tagNameRep, '>');
}
},
'endTag': function(tagName, out) {
if (ignoring) {
ignoring = false;
return;
}
if (!html4.ELEMENTS.hasOwnProperty(tagName)) { return; }
var eflags = html4.ELEMENTS[tagName];
if (!(eflags & (html4.eflags['EMPTY'] | html4.eflags['FOLDABLE']))) {
var index;
if (eflags & html4.eflags['OPTIONAL_ENDTAG']) {
for (index = stack.length; --index >= 0;) {
var stackElOrigTag = stack[index].orig;
if (stackElOrigTag === tagName) { break; }
if (!(html4.ELEMENTS[stackElOrigTag] &
html4.eflags['OPTIONAL_ENDTAG'])) {
// Don't pop non optional end tags looking for a match.
return;
}
}
} else {
for (index = stack.length; --index >= 0;) {
if (stack[index].orig === tagName) { break; }
}
}
if (index < 0) { return; } // Not opened.
for (var i = stack.length; --i > index;) {
var stackElRepTag = stack[i].rep;
if (!(html4.ELEMENTS[stackElRepTag] &
html4.eflags['OPTIONAL_ENDTAG'])) {
out.push('<\/', stackElRepTag, '>');
}
}
if (index < stack.length) {
tagName = stack[index].rep;
}
stack.length = index;
out.push('<\/', tagName, '>');
}
},
'pcdata': emit,
'rcdata': emit,
'cdata': emit,
'endDoc': function(out) {
for (; stack.length; stack.length--) {
out.push('<\/', stack[stack.length - 1].rep, '>');
}
}
});
}
var ALLOWED_URI_SCHEMES = /^(?:https?|mailto)$/i;
function safeUri(uri, effect, ltype, hints, naiveUriRewriter) {
if (!naiveUriRewriter) { return null; }
try {
var parsed = URI.parse('' + uri);
if (parsed) {
if (!parsed.hasScheme() ||
ALLOWED_URI_SCHEMES.test(parsed.getScheme())) {
var safe = naiveUriRewriter(parsed, effect, ltype, hints);
return safe ? safe.toString() : null;
}
}
} catch (e) {
return null;
}
return null;
}
function log(logger, tagName, attribName, oldValue, newValue) {
if (!attribName) {
logger(tagName + " removed", {
change: "removed",
tagName: tagName
});
}
if (oldValue !== newValue) {
var changed = "changed";
if (oldValue && !newValue) {
changed = "removed";
} else if (!oldValue && newValue) {
changed = "added";
}
logger(tagName + "." + attribName + " " + changed, {
change: changed,
tagName: tagName,
attribName: attribName,
oldValue: oldValue,
newValue: newValue
});
}
}
function lookupAttribute(map, tagName, attribName) {
var attribKey;
attribKey = tagName + '::' + attribName;
if (map.hasOwnProperty(attribKey)) {
return map[attribKey];
}
attribKey = '*::' + attribName;
if (map.hasOwnProperty(attribKey)) {
return map[attribKey];
}
return void 0;
}
function getAttributeType(tagName, attribName) {
return lookupAttribute(html4.ATTRIBS, tagName, attribName);
}
function getLoaderType(tagName, attribName) {
return lookupAttribute(html4.LOADERTYPES, tagName, attribName);
}
function getUriEffect(tagName, attribName) {
return lookupAttribute(html4.URIEFFECTS, tagName, attribName);
}
/**
* Sanitizes attributes on an HTML tag.
* @param {string} tagName An HTML tag name in lowercase.
* @param {Array.<?string>} attribs An array of alternating names and values.
* @param {?function(?string): ?string} opt_naiveUriRewriter A transform to
* apply to URI attributes; it can return a new string value, or null to
* delete the attribute. If unspecified, URI attributes are deleted.
* @param {function(?string): ?string} opt_nmTokenPolicy A transform to apply
* to attributes containing HTML names, element IDs, and space-separated
* lists of classes; it can return a new string value, or null to delete
* the attribute. If unspecified, these attributes are kept unchanged.
* @return {Array.<?string>} The sanitized attributes as a list of alternating
* names and values, where a null value means to omit the attribute.
*/
function sanitizeAttribs(tagName, attribs,
opt_naiveUriRewriter, opt_nmTokenPolicy, opt_logger) {
// TODO(felix8a): it's obnoxious that domado duplicates much of this
// TODO(felix8a): maybe consistently enforce constraints like target=
for (var i = 0; i < attribs.length; i += 2) {
var attribName = attribs[i];
var value = attribs[i + 1];
var oldValue = value;
var atype = null, attribKey;
if ((attribKey = tagName + '::' + attribName,
html4.ATTRIBS.hasOwnProperty(attribKey)) ||
(attribKey = '*::' + attribName,
html4.ATTRIBS.hasOwnProperty(attribKey))) {
atype = html4.ATTRIBS[attribKey];
}
if (atype !== null) {
switch (atype) {
case html4.atype['NONE']: break;
case html4.atype['SCRIPT']:
value = null;
if (opt_logger) {
log(opt_logger, tagName, attribName, oldValue, value);
}
break;
case html4.atype['STYLE']:
if ('undefined' === typeof parseCssDeclarations) {
value = null;
if (opt_logger) {
log(opt_logger, tagName, attribName, oldValue, value);
}
break;
}
var sanitizedDeclarations = [];
parseCssDeclarations(
value,
{
'declaration': function (property, tokens) {
var normProp = property.toLowerCase();
sanitizeCssProperty(
normProp, tokens,
opt_naiveUriRewriter
? function (url) {
return safeUri(
url, html4.ueffects.SAME_DOCUMENT,
html4.ltypes.SANDBOXED,
{
"TYPE": "CSS",
"CSS_PROP": normProp
}, opt_naiveUriRewriter);
}
: null);
if (tokens.length) {
sanitizedDeclarations.push(
normProp + ': ' + tokens.join(' '));
}
}
});
value = sanitizedDeclarations.length > 0 ?
sanitizedDeclarations.join(' ; ') : null;
if (opt_logger) {
log(opt_logger, tagName, attribName, oldValue, value);
}
break;
case html4.atype['ID']:
case html4.atype['IDREF']:
case html4.atype['IDREFS']:
case html4.atype['GLOBAL_NAME']:
case html4.atype['LOCAL_NAME']:
case html4.atype['CLASSES']:
value = opt_nmTokenPolicy ? opt_nmTokenPolicy(value) : value;
if (opt_logger) {
log(opt_logger, tagName, attribName, oldValue, value);
}
break;
case html4.atype['URI']:
value = safeUri(value,
getUriEffect(tagName, attribName),
getLoaderType(tagName, attribName),
{
"TYPE": "MARKUP",
"XML_ATTR": attribName,
"XML_TAG": tagName
}, opt_naiveUriRewriter);
if (opt_logger) {
log(opt_logger, tagName, attribName, oldValue, value);
}
break;
case html4.atype['URI_FRAGMENT']:
if (value && '#' === value.charAt(0)) {
value = value.substring(1); // remove the leading '#'
value = opt_nmTokenPolicy ? opt_nmTokenPolicy(value) : value;
if (value !== null && value !== void 0) {
value = '#' + value; // restore the leading '#'
}
} else {
value = null;
}
if (opt_logger) {
log(opt_logger, tagName, attribName, oldValue, value);
}
break;
default:
value = null;
if (opt_logger) {
log(opt_logger, tagName, attribName, oldValue, value);
}
break;
}
} else {
// ***CartoDB.js Custom start: allow data-* attributes
// As proposed in https://groups.google.com/forum/#!topic/google-caja-discuss/ihuk9fMkJMw
if (/data-[\w-]+/.test(attribName)) {
value = opt_nmTokenPolicy ? opt_nmTokenPolicy(value) : value;
} else {
value = null;
}
if (opt_logger) {
log(opt_logger, tagName, attribName, oldValue, value);
}
}
attribs[i + 1] = value;
}
return attribs;
}
/**
* Creates a tag policy that omits all tags marked UNSAFE in html4-defs.js
* and applies the default attribute sanitizer with the supplied policy for
* URI attributes and NMTOKEN attributes.
* @param {?function(?string): ?string} opt_naiveUriRewriter A transform to
* apply to URI attributes. If not given, URI attributes are deleted.
* @param {function(?string): ?string} opt_nmTokenPolicy A transform to apply
* to attributes containing HTML names, element IDs, and space-separated
* lists of classes. If not given, such attributes are left unchanged.
* @return {function(string, Array.<?string>)} A tagPolicy suitable for
* passing to html.sanitize.
*/
function makeTagPolicy(
opt_naiveUriRewriter, opt_nmTokenPolicy, opt_logger) {
return function(tagName, attribs) {
if (!(html4.ELEMENTS[tagName] & html4.eflags['UNSAFE'])) {
return {
'attribs': sanitizeAttribs(tagName, attribs,
opt_naiveUriRewriter, opt_nmTokenPolicy, opt_logger)
};
} else {
if (opt_logger) {
log(opt_logger, tagName, undefined, undefined, undefined);
}
}
};
}
/**
* Sanitizes HTML tags and attributes according to a given policy.
* @param {string} inputHtml The HTML to sanitize.
* @param {function(string, Array.<?string>)} tagPolicy A function that
* decides which tags to accept and sanitizes their attributes (see
* makeHtmlSanitizer above for details).
* @return {string} The sanitized HTML.
*/
function sanitizeWithPolicy(inputHtml, tagPolicy) {
var outputArray = [];
makeHtmlSanitizer(tagPolicy)(inputHtml, outputArray);
return outputArray.join('');
}
/**
* Strips unsafe tags and attributes from HTML.
* @param {string} inputHtml The HTML to sanitize.
* @param {?function(?string): ?string} opt_naiveUriRewriter A transform to
* apply to URI attributes. If not given, URI attributes are deleted.
* @param {function(?string): ?string} opt_nmTokenPolicy A transform to apply
* to attributes containing HTML names, element IDs, and space-separated
* lists of classes. If not given, such attributes are left unchanged.
*/
function sanitize(inputHtml,
opt_naiveUriRewriter, opt_nmTokenPolicy, opt_logger) {
var tagPolicy = makeTagPolicy(
opt_naiveUriRewriter, opt_nmTokenPolicy, opt_logger);
return sanitizeWithPolicy(inputHtml, tagPolicy);
}
// Export both quoted and unquoted names for Closure linkage.
var html = {};
html.escapeAttrib = html['escapeAttrib'] = escapeAttrib;
html.makeHtmlSanitizer = html['makeHtmlSanitizer'] = makeHtmlSanitizer;
html.makeSaxParser = html['makeSaxParser'] = makeSaxParser;
html.makeTagPolicy = html['makeTagPolicy'] = makeTagPolicy;
html.normalizeRCData = html['normalizeRCData'] = normalizeRCData;
html.sanitize = html['sanitize'] = sanitize;
html.sanitizeAttribs = html['sanitizeAttribs'] = sanitizeAttribs;
html.sanitizeWithPolicy = html['sanitizeWithPolicy'] = sanitizeWithPolicy;
html.unescapeEntities = html['unescapeEntities'] = unescapeEntities;
return html;
})(html4);
var html_sanitize = html['sanitize'];
// Exports for Closure compiler. Note this file is also cajoled
// for domado and run in an environment without 'window'
if (typeof window !== 'undefined') {
window['html'] = html;
window['html_sanitize'] = html_sanitize;
}
Reference in New Issue View Git Blame Copy Permalink