| Index: pkg/polymer/lib/safe_html.dart
|
| diff --git a/pkg/polymer/lib/safe_html.dart b/pkg/polymer/lib/safe_html.dart
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..c15dd5c5b599c080113659caf796bb36ed9e02d1
|
| --- /dev/null
|
| +++ b/pkg/polymer/lib/safe_html.dart
|
| @@ -0,0 +1,39 @@
|
| +// Copyright (c) 2011, the Dart project authors. Please see the AUTHORS file
|
| +// for details. All rights reserved. Use of this source code is governed by a
|
| +// BSD-style license that can be found in the LICENSE file.
|
| +
|
| +// TODO(sigmund): move this library to a shared package? or make part of
|
| +// dart:html?
|
| +library polymer.safe_html;
|
| +
|
| +/** Declares a string that is a well-formed HTML fragment. */
|
| +class SafeHtml {
|
| +
|
| + /** Underlying html string. */
|
| + final String _html;
|
| +
|
| + // TODO(sigmund): provide a constructor that does html validation
|
| + SafeHtml.unsafe(this._html);
|
| +
|
| + String toString() => _html;
|
| +
|
| + operator ==(other) => other is SafeHtml && _html == other._html;
|
| + int get hashCode => _html.hashCode;
|
| +}
|
| +
|
| +/**
|
| + * Declares a string that is safe to use in a Uri attribute, such as `<a href=`,
|
| + * to avoid cross-site scripting (XSS) attacks.
|
| + */
|
| +class SafeUri {
|
| + final String _uri;
|
| +
|
| + // TODO(sigmund): provide a constructor that takes or creates a Uri and
|
| + // validates that it is safe (not a javascript: scheme, for example)
|
| + SafeUri.unsafe(this._uri);
|
| +
|
| + String toString() => _uri;
|
| +
|
| + operator ==(other) => other is SafeUri && _uri == other._uri;
|
| + int get hashCode => _uri.hashCode;
|
| +}
|
|
|