Use CheckSecurityForNode to filter out insecure calls

lib/html/scripts/htmlrenamer.py

 #!/usr/bin/python
 # Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 # for details. All rights reserved. Use of this source code is governed by a
 # BSD-style license that can be found in the LICENSE file.
 
 html_interface_renames = {
     'DOMCoreException': 'DOMException',
     'DOMFormData': 'FormData',
     'DOMWindow': 'LocalWindow',
     'History': 'LocalHistory',
@@ skipping 247 matching lines @@
     "Node.get:prefix",
     "Node.set:prefix",
     "Node.get:DOCUMENT_POSITION_PRECEDING",
     "Node.get:nodeValue",
     "Node.set:nodeValue",
     "Node.get:CDATA_SECTION_NODE",
     "Node.get:nodeName",
     "Node.lookupPrefix",
     "Node.get:PROCESSING_INSTRUCTION_NODE",
     'ShadowRoot.getElementsByTagNameNS',
-    "IFrameElement.get:contentDocument",
-    "LocalWindow.get:frameElement",
     "LocalWindow.get:frames",

[blois, 2012/10/19 21:06:35]

There are a couple of filters for getSVGDocument in here which can probably be
removed as well.

[vsm, 2012/10/19 23:14:16]

Thanks, I think I got everything now.

On 2012/10/19 21:06:35, blois wrote:

     "LocalWindow.get:length",
     "LocalWindow.webkitCancelRequestAnimationFrame",
     "WheelEvent.wheelDelta",
     ])
 
 class HtmlRenamer(object):
   def __init__(self, database):
     self._database = database
 
   def RenameInterface(self, interface):
     if interface.id.startswith('HTML'):
       if any(interface.id in ['Element', 'Document']
              for interface in self._database.Hierarchy(interface)):
         return interface.id[len('HTML'):]
     elif interface.id in html_interface_renames:
       return html_interface_renames[interface.id]
     return interface.id
 
-  def RenameMember(self, interface_name, member, member_prefix=''):
+  def RenameMember(self, interface_name, member_node, member, member_prefix=''):
     """
     Returns the name of the member in the HTML library or None if the member is
     suppressed in the HTML library
     """
     interface = self._database.GetInterface(interface_name)
 
     if self._FindMatch(interface, member, member_prefix, _removed_html_members):
       return None
 
+    if 'CheckSecurityForNode' in member_node.ext_attrs:
+      return None
+
     name = self._FindMatch(interface, member, member_prefix,
                            _renamed_html_members)
     target_name = _renamed_html_members[name] if name else member
     if self._FindMatch(interface, member, member_prefix, _private_html_members):
       if not target_name.startswith('$dom_'):  # e.g. $dom_svgClassName
         target_name = '$dom_' + target_name
     return target_name
 
   def _FindMatch(self, interface, member, member_prefix, candidates):
     for interface in self._database.Hierarchy(interface):
       html_interface_name = self.RenameInterface(interface)
       member_name = html_interface_name + '.' + member
       if member_name in candidates:
         return member_name
       member_name = html_interface_name + '.' + member_prefix + member
       if member_name in candidates:
         return member_name