attribute_builders.js 2.1 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344
  1. "use strict";
  2. /**
  3. * @license
  4. * SPDX-License-Identifier: Apache-2.0
  5. */
  6. Object.defineProperty(exports, "__esModule", { value: true });
  7. exports.safeAttrPrefix = void 0;
  8. require("../environment/dev");
  9. var attribute_impl_1 = require("../internals/attribute_impl");
  10. var string_literal_1 = require("../internals/string_literal");
  11. var sensitive_attributes_1 = require("./sensitive_attributes");
  12. /**
  13. * Creates a SafeAttributePrefix object from a template literal with no
  14. * interpolations for attributes that share a common prefix guaranteed to be not
  15. * security sensitive.
  16. *
  17. * The template literal is a prefix that makes it obvious this attribute is not
  18. * security sensitive. If it doesn't, this function will throw.
  19. */
  20. function safeAttrPrefix(templ) {
  21. if (process.env.NODE_ENV !== 'production') {
  22. (0, string_literal_1.assertIsTemplateObject)(templ, true, 'safeAttr is a template literal tag function ' +
  23. 'and should be called using the tagged template syntax. ' +
  24. 'For example, safeAttr`foo`;');
  25. }
  26. var attrPrefix = templ[0].toLowerCase();
  27. if (process.env.NODE_ENV !== 'production') {
  28. if (attrPrefix.indexOf('on') === 0 || 'on'.indexOf(attrPrefix) === 0) {
  29. throw new Error("Prefix '".concat(templ[0], "' does not guarantee the attribute ") +
  30. "to be safe as it is also a prefix for event handler attributes" +
  31. "Please use 'addEventListener' to set event handlers.");
  32. }
  33. sensitive_attributes_1.SECURITY_SENSITIVE_ATTRIBUTES.forEach(function (sensitiveAttr) {
  34. if (sensitiveAttr.indexOf(attrPrefix) === 0) {
  35. throw new Error("Prefix '".concat(templ[0], "' does not guarantee the attribute ") +
  36. "to be safe as it is also a prefix for " +
  37. "the security sensitive attribute '".concat(sensitiveAttr, "'. ") +
  38. "Please use native or safe DOM APIs to set the attribute.");
  39. }
  40. });
  41. }
  42. return (0, attribute_impl_1.createAttributePrefix)(attrPrefix);
  43. }
  44. exports.safeAttrPrefix = safeAttrPrefix;