Commit Graph

7 Commits

Author SHA1 Message Date
Jacob Richman 2dcd56ef43 Format all tests.
There are far too many files here to review everyone carefully.
Spot checking most of the diffs look good as test code is generally written
with less care than application code so lots of ugly formatting get through.
If people notice files where the automated formatting bothers them feel free
to comment indicating file names and I'll move spaces within comments to make
the formatting cleaner and use comments to force block formatting as I have
done for other case where formatting looked bad.

BUG=
R=efortuna@google.com

Review-Url: https://codereview.chromium.org/2771453003 .
2017-04-17 14:53:02 -07:00
lrn@google.com 53fa5f6c0a Make html-escape also escape < and > in attributes.
Unescaped < is not allowed in strict XHTML attributes.

BUG= http://dartbug.com/21913
R=sgjesse@google.com

Review URL: https://codereview.chromium.org//1083413004

git-svn-id: https://dart.googlecode.com/svn/branches/bleeding_edge/dart@45278 260f80e4-7a28-3924-810f-c04153c831b5
2015-04-20 11:01:22 +00:00
dgrove@google.com 3c39ad2ec4 Fix off-by-one error in https://code.google.com/p/dart/source/detail?r=45153
and https://code.google.com/p/dart/source/detail?r=45154 .

R=sigmund@google.com

Review URL: https://codereview.chromium.org//1055283003

git-svn-id: https://dart.googlecode.com/svn/branches/bleeding_edge/dart@45189 260f80e4-7a28-3924-810f-c04153c831b5
2015-04-15 23:13:40 +00:00
lrn@google.com 8a5d0491e4 Make HtmlEscape escape '/' again in UNKNOWN mode.
This is a XSS-prevention recommendation.
If escaped code is only ever used inside a quoted attribute or as element text,
escapeing '/' is not necessary.
However, if the escaped code is inserted inside a tag (for example assuming
that it is a well-behavde attribute), then a slash may be meaningful in some
cases. Lots of other things can go wrong in that case, so we recommend against
it.

R=sgjesse@google.com

Review URL: https://codereview.chromium.org//1084473003

git-svn-id: https://dart.googlecode.com/svn/branches/bleeding_edge/dart@45153 260f80e4-7a28-3924-810f-c04153c831b5
2015-04-15 08:15:16 +00:00
lrn@google.com 8b8223d15c Document and fix HTML-escape.
Update documentation and behavior of HtmlEscape.

BUG= http://dartbug.com/21913, http://dartbug.com/13097
R=floitsch@google.com, sgjesse@google.com

Review URL: https://codereview.chromium.org//1019853002

git-svn-id: https://dart.googlecode.com/svn/branches/bleeding_edge/dart@45003 260f80e4-7a28-3924-810f-c04153c831b5
2015-04-09 12:45:06 +00:00
floitsch@google.com 00752e7e24 Escape slash since it helps to end an HTML entity.
Escaping a slash is recommended by the OWASP.

Replace "&apos;" in HTML escaping by "&#x27;" since "&apos;" isn't supported in the HTML4 spec.

BUG= http://dartbug.com/13364
R=efortuna@google.com, floitsch@google.com

Review URL: https://codereview.chromium.org//24339002

git-svn-id: https://dart.googlecode.com/svn/branches/bleeding_edge/dart@27945 260f80e4-7a28-3924-810f-c04153c831b5
2013-09-26 12:19:40 +00:00
kevmoo@j832.com 85e045313e adding HtmlEscape to dart:convert
BUG=https://code.google.com/p/dart/issues/detail?id=1657
R=blois@google.com, floitsch@google.com, rnystrom@google.com

Review URL: https://codereview.chromium.org//23492002

git-svn-id: https://dart.googlecode.com/svn/branches/bleeding_edge/dart@27211 260f80e4-7a28-3924-810f-c04153c831b5
2013-09-05 20:30:56 +00:00