reviewed.mjs 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115
  1. /**
  2. * @license
  3. * SPDX-License-Identifier: Apache-2.0
  4. */
  5. import '../environment/dev';
  6. import { createHtml } from '../internals/html_impl';
  7. import { createResourceUrl } from '../internals/resource_url_impl';
  8. import { createScript } from '../internals/script_impl';
  9. import { createStyle } from '../internals/style_impl';
  10. import { createStyleSheet } from '../internals/style_sheet_impl';
  11. /**
  12. * Utilities to convert arbitrary strings to values of the various
  13. * Safe HTML types, subject to security review. These are also referred to as
  14. * "reviewed conversions".
  15. *
  16. * These functions are intended for use-cases that cannot be expressed using an
  17. * existing safe API (such as a type's builder) and instead require custom code
  18. * to produce values of a Safe HTML type. A security review is required to
  19. * verify that the custom code is indeed guaranteed to produce values that
  20. * satisfy the target type's security contract.
  21. *
  22. * Code using restricted conversions should be structured such that this
  23. * property is straightforward to establish. In particular, correctness should
  24. * only depend on the code immediately surrounding the reviewed conversion, and
  25. * not on assumptions about values received from outside the enclosing function
  26. * (or, at the most, the enclosing file).
  27. */
  28. /**
  29. * Asserts that the provided justification is valid (non-empty). Throws an
  30. * exception if that is not the case.
  31. */
  32. function assertValidJustification(justification) {
  33. if (typeof justification !== 'string' || justification.trim() === '') {
  34. let errMsg = 'Calls to uncheckedconversion functions must go through security review.';
  35. errMsg += ' A justification must be provided to capture what security' +
  36. ' assumptions are being made.';
  37. throw new Error(errMsg);
  38. }
  39. }
  40. /**
  41. * Performs a "reviewed conversion" to SafeHtml from a plain string that is
  42. * known to satisfy the SafeHtml type contract.
  43. *
  44. * IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
  45. * that the value of `html` satisfies the SafeHtml type contract in all
  46. * possible program states. An appropriate `justification` must be provided
  47. * explaining why this particular use of the function is safe.
  48. */
  49. export function htmlSafeByReview(html, justification) {
  50. if (process.env.NODE_ENV !== 'production') {
  51. assertValidJustification(justification);
  52. }
  53. return createHtml(html);
  54. }
  55. /**
  56. * Performs a "reviewed conversion" to SafeScript from a plain string that
  57. * is known to satisfy the SafeScript type contract.
  58. *
  59. * IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
  60. * that the value of `script` satisfies the SafeScript type contract in
  61. * all possible program states. An appropriate `justification` must be provided
  62. * explaining why this particular use of the function is safe.
  63. */
  64. export function scriptSafeByReview(script, justification) {
  65. if (process.env.NODE_ENV !== 'production') {
  66. assertValidJustification(justification);
  67. }
  68. return createScript(script);
  69. }
  70. /**
  71. * Performs a "reviewed conversion" to TrustedResourceUrl from a plain string
  72. * that is known to satisfy the SafeUrl type contract.
  73. *
  74. * IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
  75. * that the value of `url` satisfies the TrustedResourceUrl type
  76. * contract in all possible program states. An appropriate `justification` must
  77. * be provided explaining why this particular use of the function is safe.
  78. */
  79. export function resourceUrlSafeByReview(url, justification) {
  80. if (process.env.NODE_ENV !== 'production') {
  81. assertValidJustification(justification);
  82. }
  83. return createResourceUrl(url);
  84. }
  85. /**
  86. * Performs a "reviewed conversion" to SafeStyle from a plain string that is
  87. * known to satisfy the SafeStyle type contract.
  88. *
  89. * IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
  90. * that the value of `style` satisfies the SafeStyle type contract in all
  91. * possible program states. An appropriate `justification` must be provided
  92. * explaining why this particular use of the function is safe.
  93. */
  94. export function styleSafeByReview(style, justification) {
  95. if (process.env.NODE_ENV !== 'production') {
  96. assertValidJustification(justification);
  97. }
  98. return createStyle(style);
  99. }
  100. /**
  101. * Performs a "reviewed conversion" to SafeStyleSheet from a plain string that
  102. * is known to satisfy the SafeStyleSheet type contract.
  103. *
  104. * IMPORTANT: Uses of this method must be carefully security-reviewed to ensure
  105. * that the value of `stylesheet` satisfies the SafeStyleSheet type
  106. * contract in all possible program states. An appropriate `justification` must
  107. * be provided explaining why this particular use of the function is safe; this
  108. * may include a security review ticket number.
  109. */
  110. export function styleSheetSafeByReview(stylesheet, justification) {
  111. if (process.env.NODE_ENV !== 'production') {
  112. assertValidJustification(justification);
  113. }
  114. return createStyleSheet(stylesheet);
  115. }