ember-app-scheduler
Version:
Ember addon to schedule work at different phases of app life cycle.
45 lines • 1.56 kB
JavaScript
import { normalizeTextValue } from '../compiled/opcodes/content';
import { isSafeString } from '../upsert';
const badProtocols = ['javascript:', 'vbscript:'];
const badTags = ['A', 'BODY', 'LINK', 'IMG', 'IFRAME', 'BASE', 'FORM'];
const badTagsForDataURI = ['EMBED'];
const badAttributes = ['href', 'src', 'background', 'action'];
const badAttributesForDataURI = ['src'];
function has(array, item) {
return array.indexOf(item) !== -1;
}
function checkURI(tagName, attribute) {
return (tagName === null || has(badTags, tagName)) && has(badAttributes, attribute);
}
function checkDataURI(tagName, attribute) {
if (tagName === null) return false;
return has(badTagsForDataURI, tagName) && has(badAttributesForDataURI, attribute);
}
export function requiresSanitization(tagName, attribute) {
return checkURI(tagName, attribute) || checkDataURI(tagName, attribute);
}
export function sanitizeAttributeValue(env, element, attribute, value) {
let tagName = null;
if (value === null || value === undefined) {
return value;
}
if (isSafeString(value)) {
return value.toHTML();
}
if (!element) {
tagName = null;
} else {
tagName = element.tagName.toUpperCase();
}
let str = normalizeTextValue(value);
if (checkURI(tagName, attribute)) {
let protocol = env.protocolForURL(str);
if (has(badProtocols, protocol)) {
return `unsafe:${str}`;
}
}
if (checkDataURI(tagName, attribute)) {
return `unsafe:${str}`;
}
return str;
}