Skip to content

Commit

Permalink
use allowlist rather than white list (#31575)
Browse files Browse the repository at this point in the history
s/white(.?!list(ed)?)/allow\1/gi
  • Loading branch information
patrickkettner committed Dec 13, 2020
1 parent 73307b0 commit 2f33bbe
Show file tree
Hide file tree
Showing 13 changed files with 26 additions and 26 deletions.
2 changes: 1 addition & 1 deletion ads/README.md
Expand Up @@ -312,7 +312,7 @@ For ad networks that support loading via a single script tag, this form is suppo
</amp-ad>
```

Note, that the network still needs to be white-listed and provide a prefix to valid URLs. AMP may add similar support for ad networks that support loading via an iframe tag.
Note, that the network still needs to be allow-listed and provide a prefix to valid URLs. AMP may add similar support for ad networks that support loading via an iframe tag.

Technically, the `<amp-ad>` tag loads an iframe to a generic bootstrap URL that knows how to render the ad given the parameters to the tag.

Expand Down
2 changes: 1 addition & 1 deletion ads/openx.md
Expand Up @@ -66,7 +66,7 @@ OpenX header bidding. Parameters noted in the DoubleClick amp-ad [documentation]

- `json` - Additional json options.

- `customVars` - please refer to the [documentation](https://docs.openx.com/Content/developers/ad_request_api/custom_variables_in_ad_calls.html). Also note that OpenX bidder limits these keys by the **white listed keys** set on your publisher settings.
- `customVars` - please refer to the [documentation](https://docs.openx.com/Content/developers/ad_request_api/custom_variables_in_ad_calls.html). Also note that OpenX bidder limits these keys by the **allowlisted keys** set on your publisher settings.

```html
<amp-ad
Expand Down
2 changes: 1 addition & 1 deletion extensions/amp-a4a/0.1/head-validation.js
Expand Up @@ -157,7 +157,7 @@ export function processHead(win, adElement, head) {
}

/**
* Allows json scripts and allow listed amp elements while removing others.
* Allows json scripts and allowlisted amp elements while removing others.
* @param {!Array} extensions
* @param {!Element} script
*/
Expand Down
2 changes: 1 addition & 1 deletion extensions/amp-ad/amp-ad.md
Expand Up @@ -196,7 +196,7 @@ Attributes starting with `data-vars–` are reserved for

Use this attribute to load a script tag for the specified ad network. This can
be used for ad networks that require exactly a single script tag to be inserted
in the page. The `src` value must have a prefix that is white-listed for the
in the page. The `src` value must have a prefix that is allow-listed for the
specified ad network, and the value must use `https` protocol.

### `json` (optional)
Expand Down
6 changes: 3 additions & 3 deletions extensions/amp-bind/amp-bind.md
Expand Up @@ -542,7 +542,7 @@ Using `AMP.pushState()` sets the current state to the most recent pushed state.

- Expressions may only access the containing document's [state](#state).
- Expressions **do not** have access to `window` or `document`. `global` references the top-level state.
- Only `amp-bind` [allowed-listed functions](#allowed-listed functions) and operators are usable. are usable. Use of arrow functions are allowed as function parameters, e.g. `[1, 2, 3].map(x => x + 1)`.
- Only `amp-bind` [allowlisted functions](#allowlisted-functions) and operators are usable. are usable. Use of arrow functions are allowed as function parameters, e.g. `[1, 2, 3].map(x => x + 1)`.
- Custom functions, classes and loops are disallowed.
- Undefined variables and array-index-out-of-bounds return `null` instead of `undefined` or throwing errors.
- A single expression is currently capped at 50 operands for performance. Please [contact us](https://github.com/ampproject/amphtml/issues/new) if this is insufficient for your use case.
Expand Down Expand Up @@ -579,7 +579,7 @@ The following are all valid expressions:

Find the full expression grammar and implementation in [bind-expr-impl.jison](./0.1/bind-expr-impl.jison) and [bind-expression.js](./0.1/bind-expression.js).

### Allowed-listed functions
### Allowlisted functions

#### [`Array`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array#Methods)

Expand Down Expand Up @@ -1393,7 +1393,7 @@ Below outlines the types of errors that may arise when working with `amp-bind`.
<tr>
<td class="col-thirty">Invalid binding</td>
<td class="col-fourty"><em>Binding to [foo] on &lt;P> is not allowed</em>.</td>
<td class="col-thirty">Use only <a href="#element-specific-attributes">white-listed bindings</a>.</td>
<td class="col-thirty">Use only <a href="#element-specific-attributes">allow-listed bindings</a>.</td>
</tr>
<tr>
<td>Syntax error</td>
Expand Down
4 changes: 2 additions & 2 deletions spec/amp-cache-debugging.md
Expand Up @@ -13,7 +13,7 @@ try the following:

1. Open your browser's developer/error tools console, and resolve
any errors or warnings that appear.
2. Run the document through [AMPBench](https://ampbench.appspot.com/) and
2. Run the document through [an AMP document validator](https://search.google.com/test/amp) and
resolve any unexpected errors or warnings.

If you still have a problem after following these steps, check the table below.
Expand All @@ -30,7 +30,7 @@ If you still have a problem after following these steps, check the table below.
<tbody>
<tr>
<td>Web fonts do not appear (fallback fonts are used)</td>
<td>The AMP Cache is not white listed by the font provider.</td>
<td>The AMP Cache is not allowlisted by the font provider.</td>
<td>Contact the font provider and ask them to allowlist <a href="https://amp.dev/documentation/guides-and-tutorials/learn/amp-caches-and-cors/amp-cors-requests#cors-security-in-amp">all caches</a>.</td>
</tr>
<tr>
Expand Down
12 changes: 6 additions & 6 deletions spec/amp-html-format.md
Expand Up @@ -268,7 +268,7 @@ HTML tags can be used unchanged in AMP HTML. Certain tags have equivalent custom
</tr>
<tr>
<td width="30%">link</td>
<td><code>rel</code> values registered on <a href="http://microformats.org/wiki/existing-rel-values">microformats.org</a> are allowed. If a <code>rel</code> value is missing from our white list, <a href="https://github.com/ampproject/amphtml/issues/new">please submit an issue</a>. <code>stylesheet</code> and other values like <code>preconnect</code>, <code>prerender</code> and <code>prefetch</code> that have side effects in the browser are disallowed. There is a special case for fetching stylesheets from white listed font providers.</td>
<td><code>rel</code> values registered on <a href="http://microformats.org/wiki/existing-rel-values">microformats.org</a> are allowed. If a <code>rel</code> value is missing from our allowlist, <a href="https://github.com/ampproject/amphtml/issues/new">please submit an issue</a>. <code>stylesheet</code> and other values like <code>preconnect</code>, <code>prerender</code> and <code>prefetch</code> that have side effects in the browser are disallowed. There is a special case for fetching stylesheets from allowlisted font providers.</td>
</tr>
<tr>
<td width="30%">meta</td>
Expand All @@ -284,7 +284,7 @@ HTML tags can be used unchanged in AMP HTML. Certain tags have equivalent custom
</tr>
</table>

Validator implementations should use a white list based on the HTML5 specification with the above tags removed. See [AMP Tag Addendum](amp-tag-addendum.md).
Validator implementations should use an allowlist based on the HTML5 specification with the above tags removed. See [AMP Tag Addendum](amp-tag-addendum.md).

### Comments

Expand Down Expand Up @@ -352,9 +352,9 @@ Usage of the `!important` qualifier is not allowed. This is a necessary requirem

#### Properties

AMP only allows transitions and animations of properties that can be GPU accelerated in common browsers. We currently white list: `opacity`, `transform` (also `-vendorPrefix-transform`).
AMP only allows transitions and animations of properties that can be GPU accelerated in common browsers. We currently allow: `opacity`, `transform` (also `-vendorPrefix-transform`).

In the following examples `<property>` needs to be in the white list above.
In the following examples `<property>` needs to be in the allowed list above.

- `transition <property>` (also -vendorPrefix-transition)
- `@keyframes name { from: {<property>: value} to {<property: value>} }` (also `@-vendorPrefix-keyframes`)
Expand Down Expand Up @@ -390,7 +390,7 @@ Example:

### Custom fonts

Authors may include stylesheets for custom fonts. The 2 supported methods are link tags pointing to white listed font providers and `@font-face` inclusion.
Authors may include stylesheets for custom fonts. The 2 supported methods are link tags pointing to allowlisted font providers and `@font-face` inclusion.

Example:

Expand All @@ -401,7 +401,7 @@ Example:
/>
```

Font providers can be white listed if they support CSS-only integrations and serve over HTTPS. The following origins are currently allowed for font serving via link tags:
Font providers can be allowlisted if they support CSS-only integrations and serve over HTTPS. The following origins are currently allowed for font serving via link tags:

- Fonts.com: `https://fast.fonts.net`
- Google Fonts: `https://fonts.googleapis.com`
Expand Down
6 changes: 3 additions & 3 deletions spec/amp-var-substitutions.md
Expand Up @@ -70,7 +70,7 @@ The following table lists the features that enable variable substitutions, as we
<ul>
<li>Page’s source origin</li>
<li>Page’s canonical origin</li>
<li>An origin white listed via the <code>amp-link-variable-allowed-origin</code> <code>meta</code> tag</li>
<li>An origin allowlisted via the <code>amp-link-variable-allowed-origin</code> <code>meta</code> tag</li>
</ul>
</td>
<td width="25%">Yes, via space-delimited attribute <code>data-amp-replace</code>. Read more about <a href="#per-use-opt-in">per-use opt-in</a></td>
Expand Down Expand Up @@ -131,13 +131,13 @@ If you need to append dynamic parameters to the href, specify the parameters by
>
```

### White listed domains for link substitution
### Allow listed domains for link substitution

Link substitutions are restricted and will only be fulfilled for URLs matching:

- The page’s source origin
- The page’s canonical origin
- A white listed origin
- An allowlisted origin

To allowlist an origin, include a `amp-link-variable-allowed-origin` `meta` tag in the `head` of your document. To specify multiple domains, separate each domain with a space.

Expand Down
2 changes: 1 addition & 1 deletion src/service/url-expander/expander.js
Expand Up @@ -34,7 +34,7 @@ export class Expander {
* @param {!Object<string, *>=} opt_collectVars Object passed in to collect
* variable resolutions.
* @param {boolean=} opt_sync If the method should resolve syncronously.
* @param {!Object<string, boolean>=} opt_allowlist Optional white list of names
* @param {!Object<string, boolean>=} opt_allowlist Optional allowlist of names
* that can be substituted.
* @param {boolean=} opt_noEncode Should not urlEncode macro resolution.
*/
Expand Down
6 changes: 3 additions & 3 deletions src/service/url-replacements-impl.js
Expand Up @@ -762,7 +762,7 @@ export class UrlReplacements {
* variables or override existing ones. Any async bindings are ignored.
* @param {string} source
* @param {!Object<string, (ResolverReturnDef|!SyncResolverDef)>=} opt_bindings
* @param {!Object<string, boolean>=} opt_allowlist Optional white list of
* @param {!Object<string, boolean>=} opt_allowlist Optional allowlist of
* names that can be substituted.
* @return {string}
*/
Expand Down Expand Up @@ -803,7 +803,7 @@ export class UrlReplacements {
* variables or override existing ones. Any async bindings are ignored.
* @param {string} url
* @param {!Object<string, (ResolverReturnDef|!SyncResolverDef)>=} opt_bindings
* @param {!Object<string, boolean>=} opt_allowlist Optional white list of
* @param {!Object<string, boolean>=} opt_allowlist Optional allowlist of
* names that can be substituted.
* @return {string}
*/
Expand All @@ -826,7 +826,7 @@ export class UrlReplacements {
* or override existing ones.
* @param {string} url
* @param {!Object<string, *>=} opt_bindings
* @param {!Object<string, boolean>=} opt_allowlist Optional white list of names
* @param {!Object<string, boolean>=} opt_allowlist Optional allowlist of names
* that can be substituted.
* @param {boolean=} opt_noEncode should not encode URL
* @return {!Promise<string>}
Expand Down
4 changes: 2 additions & 2 deletions src/service/variable-source.js
Expand Up @@ -271,7 +271,7 @@ export class VariableSource {
* Returns a Regular expression that can be used to detect all the variables
* in a template.
* @param {!Object<string, *>=} opt_bindings
* @param {!Object<string, boolean>=} opt_allowlist Optional white list of names
* @param {!Object<string, boolean>=} opt_allowlist Optional allowlist of names
* that can be substituted.
* @return {!RegExp}
*/
Expand All @@ -285,7 +285,7 @@ export class VariableSource {

/**
* @param {!Array<string>} keys
* @param {!Object<string, boolean>=} opt_allowlist Optional white list of names
* @param {!Object<string, boolean>=} opt_allowlist Optional allowlist of names
* that can be substituted.
* @return {!RegExp}
* @private
Expand Down
2 changes: 1 addition & 1 deletion validator/validator.pb.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion validator/validator.proto
Expand Up @@ -762,7 +762,7 @@ message DocCssSpec {
optional string max_bytes_spec_url = 8;

// Declaration allow-lists were added when style attribute validation was
// implementented. Therefore older style tags do not enforce an allow list
// implementented. Therefore older style tags do not enforce an allowlist
// of declarations. If true, all declarations are allowed in style tags,
// regardless of the contents of the `declaration` list.
optional bool allow_all_declaration_in_style_tag = 10 [default = false];
Expand Down

0 comments on commit 2f33bbe

Please sign in to comment.