From 2b4757367470d8e36bc00901dac567e375796ed4 Mon Sep 17 00:00:00 2001 From: Brian Picciano Date: Tue, 13 Nov 2018 00:24:09 -0500 Subject: update viz 2 to use the newest version, which has some performance improvements and is easier to read the code for. also update the description --- assets/viz/2/goog/dom/safe.js | 110 +++++++++++++++++++++++++++++++++++++----- 1 file changed, 98 insertions(+), 12 deletions(-) (limited to 'assets/viz/2/goog/dom/safe.js') diff --git a/assets/viz/2/goog/dom/safe.js b/assets/viz/2/goog/dom/safe.js index 012ad22..b9390a0 100644 --- a/assets/viz/2/goog/dom/safe.js +++ b/assets/viz/2/goog/dom/safe.js @@ -29,19 +29,22 @@ * * For example, assigning to an element's .innerHTML property a string that is * derived (even partially) from untrusted input typically results in an XSS - * vulnerability. The type-safe wrapper goog.html.setInnerHtml consumes a value - * of type goog.html.SafeHtml, whose contract states that using its values in a - * HTML context will not result in XSS. Hence a program that is free of direct - * assignments to any element's innerHTML property (with the exception of the - * assignment to .innerHTML in this file) is guaranteed to be free of XSS due to - * assignment of untrusted strings to the innerHTML property. + * vulnerability. The type-safe wrapper goog.dom.safe.setInnerHtml consumes a + * value of type goog.html.SafeHtml, whose contract states that using its values + * in a HTML context will not result in XSS. Hence a program that is free of + * direct assignments to any element's innerHTML property (with the exception of + * the assignment to .innerHTML in this file) is guaranteed to be free of XSS + * due to assignment of untrusted strings to the innerHTML property. */ goog.provide('goog.dom.safe'); goog.provide('goog.dom.safe.InsertAdjacentHtmlPosition'); goog.require('goog.asserts'); +goog.require('goog.dom.asserts'); goog.require('goog.html.SafeHtml'); +goog.require('goog.html.SafeScript'); +goog.require('goog.html.SafeStyle'); goog.require('goog.html.SafeUrl'); goog.require('goog.html.TrustedResourceUrl'); goog.require('goog.string'); @@ -69,12 +72,35 @@ goog.dom.safe.insertAdjacentHtml = function(node, position, html) { }; +/** + * Tags not allowed in goog.dom.safe.setInnerHtml. + * @private @const {!Object} + */ +goog.dom.safe.SET_INNER_HTML_DISALLOWED_TAGS_ = { + 'MATH': true, + 'SCRIPT': true, + 'STYLE': true, + 'SVG': true, + 'TEMPLATE': true +}; + + /** * Assigns known-safe HTML to an element's innerHTML property. * @param {!Element} elem The element whose innerHTML is to be assigned to. * @param {!goog.html.SafeHtml} html The known-safe HTML to assign. + * @throws {Error} If called with one of these tags: math, script, style, svg, + * template. */ goog.dom.safe.setInnerHtml = function(elem, html) { + if (goog.asserts.ENABLE_ASSERTS) { + var tagName = elem.tagName.toUpperCase(); + if (goog.dom.safe.SET_INNER_HTML_DISALLOWED_TAGS_[tagName]) { + throw Error( + 'goog.dom.safe.setInnerHtml cannot be used to set content of ' + + elem.tagName + '.'); + } + } elem.innerHTML = goog.html.SafeHtml.unwrap(html); }; @@ -89,6 +115,17 @@ goog.dom.safe.setOuterHtml = function(elem, html) { }; +/** + * Sets the given element's style property to the contents of the provided + * SafeStyle object. + * @param {!Element} elem + * @param {!goog.html.SafeStyle} style + */ +goog.dom.safe.setStyle = function(elem, style) { + elem.style.cssText = goog.html.SafeStyle.unwrap(style); +}; + + /** * Writes known-safe HTML to a document. * @param {!Document} doc The document to be written to. @@ -119,12 +156,13 @@ goog.dom.safe.documentWrite = function(doc, html) { * @see goog.html.SafeUrl#sanitize */ goog.dom.safe.setAnchorHref = function(anchor, url) { + goog.dom.asserts.assertIsHTMLAnchorElement(anchor); /** @type {!goog.html.SafeUrl} */ var safeUrl; if (url instanceof goog.html.SafeUrl) { safeUrl = url; } else { - safeUrl = goog.html.SafeUrl.sanitize(url); + safeUrl = goog.html.SafeUrl.sanitizeAssertUnchanged(url); } anchor.href = goog.html.SafeUrl.unwrap(safeUrl); }; @@ -143,12 +181,13 @@ goog.dom.safe.setAnchorHref = function(anchor, url) { * @see goog.html.SafeUrl#sanitize */ goog.dom.safe.setImageSrc = function(imageElement, url) { + goog.dom.asserts.assertIsHTMLImageElement(imageElement); /** @type {!goog.html.SafeUrl} */ var safeUrl; if (url instanceof goog.html.SafeUrl) { safeUrl = url; } else { - safeUrl = goog.html.SafeUrl.sanitize(url); + safeUrl = goog.html.SafeUrl.sanitizeAssertUnchanged(url); } imageElement.src = goog.html.SafeUrl.unwrap(safeUrl); }; @@ -169,6 +208,7 @@ goog.dom.safe.setImageSrc = function(imageElement, url) { * @param {!goog.html.TrustedResourceUrl} url The URL to assign. */ goog.dom.safe.setEmbedSrc = function(embed, url) { + goog.dom.asserts.assertIsHTMLEmbedElement(embed); embed.src = goog.html.TrustedResourceUrl.unwrap(url); }; @@ -188,6 +228,7 @@ goog.dom.safe.setEmbedSrc = function(embed, url) { * @param {!goog.html.TrustedResourceUrl} url The URL to assign. */ goog.dom.safe.setFrameSrc = function(frame, url) { + goog.dom.asserts.assertIsHTMLFrameElement(frame); frame.src = goog.html.TrustedResourceUrl.unwrap(url); }; @@ -207,10 +248,30 @@ goog.dom.safe.setFrameSrc = function(frame, url) { * @param {!goog.html.TrustedResourceUrl} url The URL to assign. */ goog.dom.safe.setIframeSrc = function(iframe, url) { + goog.dom.asserts.assertIsHTMLIFrameElement(iframe); iframe.src = goog.html.TrustedResourceUrl.unwrap(url); }; +/** + * Safely assigns HTML to an iframe element's srcdoc property. + * + * Example usage: + * goog.dom.safe.setIframeSrcdoc(iframeEl, safeHtml); + * which is a safe alternative to + * iframeEl.srcdoc = html; + * The latter can result in loading untrusted code. + * + * @param {!HTMLIFrameElement} iframe The iframe element whose srcdoc property + * is to be assigned to. + * @param {!goog.html.SafeHtml} html The HTML to assign. + */ +goog.dom.safe.setIframeSrcdoc = function(iframe, html) { + goog.dom.asserts.assertIsHTMLIFrameElement(iframe); + iframe.srcdoc = goog.html.SafeHtml.unwrap(html); +}; + + /** * Safely sets a link element's href and rel properties. Whether or not * the URL assigned to href has to be a goog.html.TrustedResourceUrl @@ -237,6 +298,7 @@ goog.dom.safe.setIframeSrc = function(iframe, url) { * @see goog.html.SafeUrl#sanitize */ goog.dom.safe.setLinkHrefAndRel = function(link, url, rel) { + goog.dom.asserts.assertIsHTMLLinkElement(link); link.rel = rel; if (goog.string.caseInsensitiveContains(rel, 'stylesheet')) { goog.asserts.assert( @@ -249,7 +311,8 @@ goog.dom.safe.setLinkHrefAndRel = function(link, url, rel) { link.href = goog.html.SafeUrl.unwrap(url); } else { // string // SafeUrl.sanitize must return legitimate SafeUrl when passed a string. - link.href = goog.html.SafeUrl.sanitize(url).getTypedStringValue(); + link.href = + goog.html.SafeUrl.sanitizeAssertUnchanged(url).getTypedStringValue(); } }; @@ -269,12 +332,13 @@ goog.dom.safe.setLinkHrefAndRel = function(link, url, rel) { * @param {!goog.html.TrustedResourceUrl} url The URL to assign. */ goog.dom.safe.setObjectData = function(object, url) { + goog.dom.asserts.assertIsHTMLObjectElement(object); object.data = goog.html.TrustedResourceUrl.unwrap(url); }; /** - * Safely assigns a URL to an iframe element's src property. + * Safely assigns a URL to a script element's src property. * * Example usage: * goog.dom.safe.setScriptSrc(scriptEl, url); @@ -288,10 +352,31 @@ goog.dom.safe.setObjectData = function(object, url) { * @param {!goog.html.TrustedResourceUrl} url The URL to assign. */ goog.dom.safe.setScriptSrc = function(script, url) { + goog.dom.asserts.assertIsHTMLScriptElement(script); script.src = goog.html.TrustedResourceUrl.unwrap(url); }; +/** + * Safely assigns a value to a script element's content. + * + * Example usage: + * goog.dom.safe.setScriptContent(scriptEl, content); + * which is a safe alternative to + * scriptEl.text = content; + * The latter can result in executing untrusted code unless it is ensured that + * the code is loaded from a trustworthy resource. + * + * @param {!HTMLScriptElement} script The script element whose content is being + * set. + * @param {!goog.html.SafeScript} content The content to assign. + */ +goog.dom.safe.setScriptContent = function(script, content) { + goog.dom.asserts.assertIsHTMLScriptElement(script); + script.text = goog.html.SafeScript.unwrap(content); +}; + + /** * Safely assigns a URL to a Location object's href property. * @@ -312,12 +397,13 @@ goog.dom.safe.setScriptSrc = function(script, url) { * @see goog.html.SafeUrl#sanitize */ goog.dom.safe.setLocationHref = function(loc, url) { + goog.dom.asserts.assertIsLocation(loc); /** @type {!goog.html.SafeUrl} */ var safeUrl; if (url instanceof goog.html.SafeUrl) { safeUrl = url; } else { - safeUrl = goog.html.SafeUrl.sanitize(url); + safeUrl = goog.html.SafeUrl.sanitizeAssertUnchanged(url); } loc.href = goog.html.SafeUrl.unwrap(safeUrl); }; @@ -358,7 +444,7 @@ goog.dom.safe.openInWindow = function( if (url instanceof goog.html.SafeUrl) { safeUrl = url; } else { - safeUrl = goog.html.SafeUrl.sanitize(url); + safeUrl = goog.html.SafeUrl.sanitizeAssertUnchanged(url); } var win = opt_openerWin || window; return win.open( -- cgit v1.2.3