b38dea0597
Share Gaia assets and adapters, keep private profiles and development documents local, and update both public READMEs.
87 lines
2.3 KiB
JavaScript
Executable file
87 lines
2.3 KiB
JavaScript
Executable file
/* globals define, module */
|
|
|
|
/**
|
|
* A simple library to help you escape HTML using template strings.
|
|
*
|
|
* It's the counterpart to our eslint "no-unsafe-innerhtml" plugin that helps us
|
|
* avoid unsafe coding practices.
|
|
* A full write-up of the Hows and Whys are documented
|
|
* for developers at
|
|
* https://developer.mozilla.org/en-US/Firefox_OS/Security/Security_Automation
|
|
* with additional background information and design docs at
|
|
* https://wiki.mozilla.org/User:Fbraun/Gaia/SafeinnerHTMLRoadmap
|
|
*
|
|
*/
|
|
(function (root, factory) {
|
|
'use strict';
|
|
if (typeof define === 'function' && define.amd) {
|
|
define(factory);
|
|
} else if (typeof exports === 'object') {
|
|
module.exports = factory();
|
|
} else {
|
|
root.Sanitizer = factory();
|
|
}
|
|
}(this, function () {
|
|
'use strict';
|
|
|
|
var Sanitizer = {
|
|
_entity: /[&<>"'/]/g,
|
|
|
|
_entities: {
|
|
'&': '&',
|
|
'<': '<',
|
|
'>': '>',
|
|
'"': '"',
|
|
'\'': ''',
|
|
'/': '/'
|
|
},
|
|
|
|
getEntity: function (s) {
|
|
return Sanitizer._entities[s];
|
|
},
|
|
|
|
/**
|
|
* Escapes HTML for all values in a tagged template string.
|
|
*/
|
|
escapeHTML: function (strings, ...values) {
|
|
var result = '';
|
|
|
|
for (var i = 0; i < strings.length; i++) {
|
|
result += strings[i];
|
|
if (i < values.length) {
|
|
result += String(values[i]).replace(Sanitizer._entity,
|
|
Sanitizer.getEntity);
|
|
}
|
|
}
|
|
|
|
return result;
|
|
},
|
|
/**
|
|
* Escapes HTML and returns a wrapped object to be used during DOM insertion
|
|
*/
|
|
createSafeHTML: function (strings, ...values) {
|
|
var escaped = Sanitizer.escapeHTML(strings, ...values);
|
|
return {
|
|
__html: escaped,
|
|
toString: function () {
|
|
return '[object WrappedHTMLObject]';
|
|
},
|
|
info: 'This is a wrapped HTML object. See https://developer.mozilla.or'+
|
|
'g/en-US/Firefox_OS/Security/Security_Automation for more.'
|
|
};
|
|
},
|
|
/**
|
|
* Unwrap safe HTML created by createSafeHTML or a custom replacement that
|
|
* underwent security review.
|
|
*/
|
|
unwrapSafeHTML: function (...htmlObjects) {
|
|
var markupList = htmlObjects.map(function(obj) {
|
|
return obj.__html;
|
|
});
|
|
return markupList.join('');
|
|
}
|
|
};
|
|
|
|
return Sanitizer;
|
|
|
|
}));
|