amp-mustache: Output user errors when elements/attributes are sanitized #20285
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/to @alabiaga |
alabiaga
approved these changes
Jan 15, 2019
| user().error(TAG, `Removed unsafe attribute: ${name}="${value}"`); | ||
| } else if (r.element) { | ||
| const {nodeName} = r.element; | ||
| if (nodeName !== 'REMOVE') { // <remove> is added by DOMPurify. |
There was a problem hiding this comment.
why not just combine nodeName check in the initial element check.
if (r.attribute) {
const {name, value} = r.attribute;
user().error(TAG, `Removed unsafe attribute: ${name}="${value}"`);
} else if (r.element && r.element.nodeName !== 'REMOVE') {
...
}
There was a problem hiding this comment.
This reads more like prose to me:
// If an attribute is removed...
// Otherwise, if an element is removed...
// If the element is <remove>...
| // Skip Edge, which throws "Permission denied" errors when inspecting | ||
| // element properties in the testing iframe (Edge 17, Windows 10). | ||
| describe.configure().skipEdge().run('amp-bind', function() { | ||
| // Give more than default 2000ms timeout for local testing. |
There was a problem hiding this comment.
we should we keep this comment and move it to where you declared TIMEOUT.
There was a problem hiding this comment.
We're not referencing mochaTimeout anymore, so there's no need to refer to "default timeout".
noranazmy
pushed a commit
to noranazmy/amphtml
that referenced
this pull request
Mar 22, 2019
…ed (ampproject#20285) * Output user errors for elements/attrs sanitized by DOMPurify. * Make sanitizer error format consistent. * Add documentation with sanitization caveat. * Increase timeout of test-amp-bind to 15s.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #17897.