Source file src/pkg/html/template/attr.go
1 // Copyright 2011 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package template 6 7 import ( 8 "strings" 9 ) 10 11 // attrTypeMap[n] describes the value of the given attribute. 12 // If an attribute affects (or can mask) the encoding or interpretation of 13 // other content, or affects the contents, idempotency, or credentials of a 14 // network message, then the value in this map is contentTypeUnsafe. 15 // This map is derived from HTML5, specifically 16 // http://www.w3.org/TR/html5/Overview.html#attributes-1 17 // as well as "%URI"-typed attributes from 18 // http://www.w3.org/TR/html4/index/attributes.html 19 var attrTypeMap = map[string]contentType{ 20 "accept": contentTypePlain, 21 "accept-charset": contentTypeUnsafe, 22 "action": contentTypeURL, 23 "alt": contentTypePlain, 24 "archive": contentTypeURL, 25 "async": contentTypeUnsafe, 26 "autocomplete": contentTypePlain, 27 "autofocus": contentTypePlain, 28 "autoplay": contentTypePlain, 29 "background": contentTypeURL, 30 "border": contentTypePlain, 31 "checked": contentTypePlain, 32 "cite": contentTypeURL, 33 "challenge": contentTypeUnsafe, 34 "charset": contentTypeUnsafe, 35 "class": contentTypePlain, 36 "classid": contentTypeURL, 37 "codebase": contentTypeURL, 38 "cols": contentTypePlain, 39 "colspan": contentTypePlain, 40 "content": contentTypeUnsafe, 41 "contenteditable": contentTypePlain, 42 "contextmenu": contentTypePlain, 43 "controls": contentTypePlain, 44 "coords": contentTypePlain, 45 "crossorigin": contentTypeUnsafe, 46 "data": contentTypeURL, 47 "datetime": contentTypePlain, 48 "default": contentTypePlain, 49 "defer": contentTypeUnsafe, 50 "dir": contentTypePlain, 51 "dirname": contentTypePlain, 52 "disabled": contentTypePlain, 53 "draggable": contentTypePlain, 54 "dropzone": contentTypePlain, 55 "enctype": contentTypeUnsafe, 56 "for": contentTypePlain, 57 "form": contentTypeUnsafe, 58 "formaction": contentTypeURL, 59 "formenctype": contentTypeUnsafe, 60 "formmethod": contentTypeUnsafe, 61 "formnovalidate": contentTypeUnsafe, 62 "formtarget": contentTypePlain, 63 "headers": contentTypePlain, 64 "height": contentTypePlain, 65 "hidden": contentTypePlain, 66 "high": contentTypePlain, 67 "href": contentTypeURL, 68 "hreflang": contentTypePlain, 69 "http-equiv": contentTypeUnsafe, 70 "icon": contentTypeURL, 71 "id": contentTypePlain, 72 "ismap": contentTypePlain, 73 "keytype": contentTypeUnsafe, 74 "kind": contentTypePlain, 75 "label": contentTypePlain, 76 "lang": contentTypePlain, 77 "language": contentTypeUnsafe, 78 "list": contentTypePlain, 79 "longdesc": contentTypeURL, 80 "loop": contentTypePlain, 81 "low": contentTypePlain, 82 "manifest": contentTypeURL, 83 "max": contentTypePlain, 84 "maxlength": contentTypePlain, 85 "media": contentTypePlain, 86 "mediagroup": contentTypePlain, 87 "method": contentTypeUnsafe, 88 "min": contentTypePlain, 89 "multiple": contentTypePlain, 90 "name": contentTypePlain, 91 "novalidate": contentTypeUnsafe, 92 // Skip handler names from 93 // http://www.w3.org/TR/html5/Overview.html#event-handlers-on-elements-document-objects-and-window-objects 94 // since we have special handling in attrType. 95 "open": contentTypePlain, 96 "optimum": contentTypePlain, 97 "pattern": contentTypeUnsafe, 98 "placeholder": contentTypePlain, 99 "poster": contentTypeURL, 100 "profile": contentTypeURL, 101 "preload": contentTypePlain, 102 "pubdate": contentTypePlain, 103 "radiogroup": contentTypePlain, 104 "readonly": contentTypePlain, 105 "rel": contentTypeUnsafe, 106 "required": contentTypePlain, 107 "reversed": contentTypePlain, 108 "rows": contentTypePlain, 109 "rowspan": contentTypePlain, 110 "sandbox": contentTypeUnsafe, 111 "spellcheck": contentTypePlain, 112 "scope": contentTypePlain, 113 "scoped": contentTypePlain, 114 "seamless": contentTypePlain, 115 "selected": contentTypePlain, 116 "shape": contentTypePlain, 117 "size": contentTypePlain, 118 "sizes": contentTypePlain, 119 "span": contentTypePlain, 120 "src": contentTypeURL, 121 "srcdoc": contentTypeHTML, 122 "srclang": contentTypePlain, 123 "start": contentTypePlain, 124 "step": contentTypePlain, 125 "style": contentTypeCSS, 126 "tabindex": contentTypePlain, 127 "target": contentTypePlain, 128 "title": contentTypePlain, 129 "type": contentTypeUnsafe, 130 "usemap": contentTypeURL, 131 "value": contentTypeUnsafe, 132 "width": contentTypePlain, 133 "wrap": contentTypePlain, 134 "xmlns": contentTypeURL, 135 } 136 137 // attrType returns a conservative (upper-bound on authority) guess at the 138 // type of the named attribute. 139 func attrType(name string) contentType { 140 name = strings.ToLower(name) 141 if strings.HasPrefix(name, "data-") { 142 // Strip data- so that custom attribute heuristics below are 143 // widely applied. 144 // Treat data-action as URL below. 145 name = name[5:] 146 } else if colon := strings.IndexRune(name, ':'); colon != -1 { 147 if name[:colon] == "xmlns" { 148 return contentTypeURL 149 } 150 // Treat svg:href and xlink:href as href below. 151 name = name[colon+1:] 152 } 153 if t, ok := attrTypeMap[name]; ok { 154 return t 155 } 156 // Treat partial event handler names as script. 157 if strings.HasPrefix(name, "on") { 158 return contentTypeJS 159 } 160 161 // Heuristics to prevent "javascript:..." injection in custom 162 // data attributes and custom attributes like g:tweetUrl. 163 // http://www.w3.org/TR/html5/elements.html#embedding-custom-non-visible-data-with-the-data-attributes: 164 // "Custom data attributes are intended to store custom data 165 // private to the page or application, for which there are no 166 // more appropriate attributes or elements." 167 // Developers seem to store URL content in data URLs that start 168 // or end with "URI" or "URL". 169 if strings.Contains(name, "src") || 170 strings.Contains(name, "uri") || 171 strings.Contains(name, "url") { 172 return contentTypeURL 173 } 174 return contentTypePlain 175 }