1
0
mirror of https://github.com/golang/go synced 2024-11-22 01:54:42 -07:00
The Go programming language
Go to file
Mike Samuel f17e3d2288 exp/template/html: handle custom attrs and HTML5 embedded elements.
HTML5 allows embedded SVG and MathML.
Code searches show SVG is used for graphing.

This changes transition to deal with constructs like
   <svg xmlns:xlink="http://www.w3.org/1999/xlink">
It changes attr and clients to call a single function that combines
the name lookup and "on" prefix check to determine an attribute
value type given an attribute name.

That function uses heuristics to recognize that
     xlink:href and svg:href
have URL content, and that data-url is likely contains URL content,
since "javascript:" injection is such a problem.

I did a code search over a closure templates codebase to determine
patterns of custom attribute usage.  I did something like

$ find . -name \*.soy | \
    xargs egrep perl -ne 'while (s/\b((data-|\w+:)\w+)\s*=//) { print "$1\n"; }' | \
    sort | uniq

to produce the list at the bottom.

Filtering that by egrep -i 'src|url|uri' produces

data-docConsumptionUri
data-docIconUrl
data-launchUrl
data-lazySrc
data-pageUrl
data-shareurl
data-suggestServerUrl
data-tweetUrl
g:secondaryurls
g:url

which seem to match all the ones that are likely URL content.
There are some short words that match that heuristic, but I still think it decent since
any custom attribute that has a numeric or enumerated keyword value will be unaffected by
the URL assumption.
Counterexamples from /usr/share/dict:
during, hourly, maturity, nourish, purloin, security, surly

Custom attributes present in existing closure templates codebase:
buzz:aid
data-a
data-action
data-actor
data-allowEqualityOps
data-analyticsId
data-bid
data-c
data-cartId
data-categoryId
data-cid
data-command
data-count
data-country
data-creativeId
data-cssToken
data-dest
data-docAttribution
data-docConsumptionUri
data-docCurrencyCode
data-docIconUrl
data-docId
data-docPrice
data-docPriceMicros
data-docTitle
data-docType
data-docid
data-email
data-entityid
data-errorindex
data-f
data-feature
data-fgid
data-filter
data-fireEvent
data-followable
data-followed
data-hashChange
data-height
data-hover
data-href
data-id
data-index
data-invitable
data-isFree
data-isPurchased
data-jid
data-jumpid
data-launchUrl
data-lazySrc
data-listType
data-maxVisiblePages
data-name
data-nid
data-nodeid
data-numItems
data-numPerPage
data-offerType
data-oid
data-opUsesEquality
data-overflowclass
data-packageName
data-pageId
data-pageUrl
data-pos
data-priceBrief
data-profileIds
data-query
data-rating
data-ref
data-rentalGrantPeriodDays
data-rentalactivePeriodHours
data-reviewId
data-role
data-score
data-shareurl
data-showGeLe
data-showLineInclude
data-size
data-sortval
data-suggestServerType
data-suggestServerUrl
data-suggestionIndex
data-tabBarId
data-tabBarIndex
data-tags
data-target
data-textColor
data-theme
data-title
data-toggletarget
data-tooltip
data-trailerId
data-transactionId
data-transition
data-ts
data-tweetContent
data-tweetUrl
data-type
data-useAjax
data-value
data-width
data-x
dm:index
dm:type
g:aspects
g:decorateusingsecondary
g:em
g:entity
g:groups
g:id
g:istoplevel
g:li
g:numresults
g:oid
g:parentId
g:pl
g:pt
g:rating_override
g:secondaryurls
g:sortby
g:startindex
g:target
g:type
g:url
g:value
ga:barsize
ga:css
ga:expandAfterCharsExceed
ga:initialNumRows
ga:nocancelicon
ga:numRowsToExpandTo
ga:type
ga:unlockwhenrated
gw:address
gw:businessname
gw:comment
gw:phone
gw:source
ng:controller
xlink:href
xml:lang
xmlns:atom
xmlns:dc
xmlns:jstd
xmlns:ng
xmlns:og
xmlns:webstore
xmlns:xlink

R=nigeltao
CC=golang-dev
https://golang.org/cl/5119041
2011-09-28 14:07:48 -07:00
doc doc: fix memory model read visibility bug 2011-09-26 12:54:30 -04:00
include 5a, 5c, 6a, 6c, 8a, 8c: fix Windows file paths 2011-09-07 15:49:56 -04:00
lib codereview: extra repo sanity check 2011-09-26 18:32:16 -04:00
misc vim: Send GoFmt errors to a location list 2011-09-23 09:38:10 +10:00
src exp/template/html: handle custom attrs and HTML5 embedded elements. 2011-09-28 14:07:48 -07:00
test test: fix windows build 2011-09-27 09:13:00 -04:00
.hgignore codereview: save CL messages in $(hg root)/last-change 2011-09-20 14:56:15 -04:00
.hgtags tag weekly.2011-09-21 2011-09-22 15:08:23 +10:00
AUTHORS A&C: Add Paul Sbarra. 2011-09-22 13:05:13 +10:00
CONTRIBUTORS A&C: Add Paul Sbarra. 2011-09-22 13:05:13 +10:00
favicon.ico add a favicon plus a couple of hi-res versions of gordon 2009-10-26 10:13:07 -07:00
LICENSE LICENSE: separate, change PATENTS text 2010-12-06 16:31:59 -05:00
PATENTS LICENSE: separate, change PATENTS text 2010-12-06 16:31:59 -05:00
README build: update, streamline documentation for new $GOBIN 2010-08-24 20:00:50 -04:00
robots.txt godoc: serve robots.txt raw 2011-02-19 05:46:20 +11:00

This is the source code repository for the Go programming language.  

For documentation about how to install and use Go,
visit http://golang.org/ or load doc/install.html in your web browser.

After installing Go, you can view a nicely formatted
doc/install.html by running godoc --http=:6060
and then visiting http://localhost:6060/doc/install.html.

Unless otherwise noted, the Go source files are distributed
under the BSD-style license found in the LICENSE file.

--

Binary Distribution Notes

If you have just untarred a binary Go distribution, you need to set
the environment variable $GOROOT to the full path of the go
directory (the one containing this README).  You can omit the
variable if you unpack it into /usr/local/go, or if you rebuild
from sources by running all.bash (see doc/install.html).
You should also add the Go binary directory $GOROOT/bin
to your shell's path.

For example, if you extracted the tar file into $HOME/go, you might
put the following in your .profile:

    export GOROOT=$HOME/go
    export PATH=$PATH:$GOROOT/bin

See doc/install.html for more details.