Add ignores for dynamic calls in html_dart2js sanitizing code.

Avoid removing dynamic invocations in sanitizing code as we don't know what type the element and its attributes may be.

Change-Id: I057d908027befe7fd284bf4ec6c68bd1d0e977f4
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/259108
Reviewed-by: Srujan Gaddam <srujzs@google.com>
Reviewed-by: Leaf Petersen <leafp@google.com>
Commit-Queue: Kallen Tu <kallentu@google.com>
This commit is contained in:
Kallen Tu
2022-09-14 20:35:04 +00:00
committed by Commit Bot
parent 8541965089
commit 586efdfe59
2 changed files with 18 additions and 2 deletions
+9 -1
View File
@@ -41126,7 +41126,11 @@ class _ValidatingTreeSanitizer implements NodeTreeSanitizer {
var isAttr;
try {
// If getting/indexing attributes throws, count that as corrupt.
// Don't remove dynamic calls in sanitizing code.
// ignore: avoid_dynamic_calls
attrs = element.attributes;
// Don't remove dynamic calls in sanitizing code.
// ignore: avoid_dynamic_calls
isAttr = attrs['is'];
var corruptedTest1 = Element._hasCorruptedAttributes(element);
@@ -41187,7 +41191,11 @@ class _ValidatingTreeSanitizer implements NodeTreeSanitizer {
for (var i = attrs.length - 1; i >= 0; --i) {
var name = keys[i];
if (!validator.allowsAttribute(
element, name.toLowerCase(), attrs[name])) {
element,
// Don't remove dynamic calls in sanitizing code.
// ignore: avoid_dynamic_calls
name.toLowerCase(),
attrs[name])) {
window.console.warn('Removing disallowed attribute '
'<$tag $name="${attrs[name]}">');
attrs.remove(name);
+9 -1
View File
@@ -229,7 +229,11 @@ class _ValidatingTreeSanitizer implements NodeTreeSanitizer {
var isAttr;
try {
// If getting/indexing attributes throws, count that as corrupt.
// Don't remove dynamic calls in sanitizing code.
// ignore: avoid_dynamic_calls
attrs = element.attributes;
// Don't remove dynamic calls in sanitizing code.
// ignore: avoid_dynamic_calls
isAttr = attrs['is'];
var corruptedTest1 = Element._hasCorruptedAttributes(element);
@@ -290,7 +294,11 @@ class _ValidatingTreeSanitizer implements NodeTreeSanitizer {
for (var i = attrs.length - 1; i >= 0; --i) {
var name = keys[i];
if (!validator.allowsAttribute(
element, name.toLowerCase(), attrs[name])) {
element,
// Don't remove dynamic calls in sanitizing code.
// ignore: avoid_dynamic_calls
name.toLowerCase(),
attrs[name])) {
window.console.warn('Removing disallowed attribute '
'<$tag $name="${attrs[name]}">');
attrs.remove(name);