Converts a {@link SafeScript} into a Soy {@link SanitizedContent} of kind JS.
8874
public static SanitizedContent fromSafeScript(SafeScript script) {
    return SanitizedContent.create(script.getSafeScriptString(), ContentKind.JS);
  }
333517
public SafeScript toSafeScript() {
    Preconditions.checkState(
        getContentKind() == ContentKind.JS,
        "toSafeScript() only valid for SanitizedContent of kind JS, is: %s",
        getContentKind());
    return UncheckedConversions.safeScriptFromStringKnownToSatisfyTypeContract(getContent());
  }
1336897
public static SoyString checkSoyString(Object o) {
    // if it isn't a sanitized content we don't want to warn and if it isn't a soystring we should
    // always fail.
    if (o instanceof SoyString
        && o instanceof SanitizedContent
        && ((SanitizedContent) o).getContentKind() != ContentKind.TEXT
        && logger.isLoggable(Level.WARNING)) {
      logger.log(
          Level.WARNING,
          String.format(
              "Passing in sanitized content into a template that accepts only string is forbidden. "
                  + " Please modify the template to take in %s.",
              ((SanitizedContent) o).getContentKind()),
          new Exception());
    }
    return (SoyString) o;
  }
854860
public static String filterHtmlElementName(SoyValue value) {
    value = normalizeNull(value);
    return filterHtmlElementName(value.coerceToString());
  }
964992
function sanitizeHtml(unsafeHtmlInput) {
	        try {
	            var containerEl = getInertElement();
	            // Make sure unsafeHtml is actually a string (TypeScript types are not enforced at runtime).
	            var unsafeHtml = unsafeHtmlInput ? String(unsafeHtmlInput) : '';
	            // mXSS protection. Repeatedly parse the document to make sure it stabilizes, so that a browser
	            // trying to auto-correct incorrect HTML cannot cause formerly inert HTML to become dangerous.
	            var mXSSAttempts = 5;
	            var parsedHtml = unsafeHtml;
	            do {
	                if (mXSSAttempts === 0) {
	                    throw new Error('Failed to sanitize html because the input is unstable');
	                }
	                mXSSAttempts--;
	                unsafeHtml = parsedHtml;
	                DOM.setInnerHTML(containerEl, unsafeHtml);
	                if (DOM.defaultDoc().documentMode) {
	                    // strip custom-namespaced attributes on IE<=11
	                    stripCustomNsAttrs(containerEl);
	                }
	                parsedHtml = DOM.getInnerHTML(containerEl);
	            } while (unsafeHtml !== parsedHtml);
	            var sanitizer = new SanitizingHtmlSerializer();
	            var safeHtml = sanitizer.sanitizeChildren(DOM.getTemplateContent(containerEl) || containerEl);
	            // Clear out the body element.
	            var parent_1 = DOM.getTemplateContent(containerEl) || containerEl;
	            for (var _i = 0, _a = DOM.childNodesAsList(parent_1); _i < _a.length; _i++) {
	                var child = _a[_i];
	                DOM.removeChild(parent_1, child);
	            }
	            if (_angular_core.isDevMode() && sanitizer.sanitizedSomething) {
	                DOM.log('WARNING: sanitizing HTML stripped some content (see http://g.co/ng/security#xss).');
	            }
	            return safeHtml;
	        }
	        catch (e) {
	            // In case anything goes wrong, clear out inertElement to reset the entire DOM structure.
	            inertElement = null;
	            throw e;
	        }
	    }
92664
function sanitizeStyle(value) {
	        value = String(value).trim(); // Make sure it's actually a string.
	        if (!value)
	            return '';
	        // Single url(...) values are supported, but only for URLs that sanitize cleanly. See above for
	        // reasoning behind this.
	        var urlMatch = value.match(URL_RE);
	        if ((urlMatch && sanitizeUrl(urlMatch[1]) === urlMatch[1]) ||
	            value.match(SAFE_STYLE_VALUE) && hasBalancedQuotes(value)) {
	            return value; // Safe style values.
	        }
	        if (_angular_core.isDevMode()) {
	            getDOM().log("WARNING: sanitizing unsafe style value " + value + " (see http://g.co/ng/security#xss).");
	        }
	        return 'unsafe';
	    }
709690
public static Expression constantSanitizedContentKindAsContentKind(
      @Nullable SanitizedContentKind kind) {
    return (kind == null)
        ? BytecodeUtils.constantNull(CONTENT_KIND_TYPE)
        : FieldRef.enumReference(ContentKind.valueOf(kind.name())).accessor();
  }
1120764
function _sanitizeHtml(defaultDoc, unsafeHtmlInput) {
    var inertBodyElement = null;
    try {
        inertBodyHelper = inertBodyHelper || new InertBodyHelper(defaultDoc);
        // Make sure unsafeHtml is actually a string (TypeScript types are not enforced at runtime).
        var unsafeHtml = unsafeHtmlInput ? String(unsafeHtmlInput) : '';
        inertBodyElement = inertBodyHelper.getInertBodyElement(unsafeHtml);
        // mXSS protection. Repeatedly parse the document to make sure it stabilizes, so that a browser
        // trying to auto-correct incorrect HTML cannot cause formerly inert HTML to become dangerous.
        var mXSSAttempts = 5;
        var parsedHtml = unsafeHtml;
        do {
            if (mXSSAttempts === 0) {
                throw new Error('Failed to sanitize html because the input is unstable');
            }
            mXSSAttempts--;
            unsafeHtml = parsedHtml;
            parsedHtml = inertBodyElement.innerHTML;
            inertBodyElement = inertBodyHelper.getInertBodyElement(unsafeHtml);
        } while (unsafeHtml !== parsedHtml);
        var sanitizer = new SanitizingHtmlSerializer();
        var safeHtml = sanitizer.sanitizeChildren(getTemplateContent(inertBodyElement) || inertBodyElement);
        if (isDevMode() && sanitizer.sanitizedSomething) {
            console.warn('WARNING: sanitizing HTML stripped some content (see http://g.co/ng/security#xss).');
        }
        return safeHtml;
    }
    finally {
        // In case anything goes wrong, clear out inertElement to reset the entire DOM structure.
        if (inertBodyElement) {
            var parent_1 = getTemplateContent(inertBodyElement) || inertBodyElement;
            while (parent_1.firstChild) {
                parent_1.removeChild(parent_1.firstChild);
            }
        }
    }
}
559465
public static SanitizedContent filterSipUri(SoyValue value) {
    value = normalizeNull(value);
    return filterSipUri(value.coerceToString());
  }
272780
def _deserialize(self, value, attr, data):
        """"""
        value = super(SanitizedHTML, self)._deserialize(value, attr, data)
        return bleach.clean(
            value,
            tags=self.tags,
            attributes=self.attrs,
            strip=True,
        ).strip()
356890
public static SanitizedContent jsIdentifier(String identifier) {
    checkArgument(
        VALID_JS_IDENTIFIER_PATTERN.matcher(identifier).matches(),
        "JS identifier '%s' should match the pattern '%s'",
        identifier,
        VALID_JS_IDENTIFIER_PATTERN.pattern());
    checkArgument(
        !INVALID_JS_IDENTIFIERS.contains(identifier),
        "JS identifier '%s' should not be a reserved word or match a literal",
        identifier);
    return UnsafeSanitizedContentOrdainer.ordainAsSafe(identifier, ContentKind.JS);
  }
690947
private Source sanitizeXml(@Nullable String xml) {
    if (xml != null && !sensitiveXPathStrings.isEmpty()) {
      try {
        DocumentBuilder documentBuilder = documentBuilderSupplier.get();
        XPath xpath = xpathSupplier.get();
        if (documentBuilder != null && xpath != null) {
          Document doc = documentBuilder.parse(new InputSource(new StringReader(xml)));
          for (String xpathString : sensitiveXPathStrings) {
            XPathExpression expr = xpath.compile(xpathString);
            Node node = (Node) expr.evaluate(doc, XPathConstants.NODE);
            if (node != null && node.getTextContent() != null) {
              node.setTextContent("REDACTED");
            }
          }
          return new DOMSource(doc);
        }
      } catch (SAXException e) {
        libLogger.warn("Unable to parse XML: {}", e);
      } catch (IOException e) {
        libLogger.warn("Unable to parse XML: {}", e);
      } catch (XPathExpressionException e) {
        libLogger.warn("Unable to parse XML: {}", e);
      }
    }
    return null;
  }
906766
public static String sanitize(String s) {
        if (s != null) {
            StringBuilder b = new StringBuilder(s.length());
            for (int i = 0, count = s.length(); i < count; i++) {
                char c = s.charAt(i);
                switch (c) {
                case '<':
                    b.append("&lt;");
                    break;
                case '>':
                    b.append("&gt;");
                    break;
                case '\'':
                    b.append("&#39;");
                    break;
                case '"':
                    b.append("&quot;");
                    break;
                case '&':
                    b.append("&amp;");
                    break;
                default:
                    b.append(c);
                }
            }
            return b.toString();
        }
        return "";
    }
520506
public static SanitizedContent fromSafeHtmlProto(SafeHtmlProto html) {
    return SanitizedContent.create(SafeHtmls.fromProto(html).getSafeHtmlString(), ContentKind.HTML);
  }
648764
public static SanitizedContent fromTrustedResourceUrl(TrustedResourceUrl url) {
    return SanitizedContent.create(
        url.getTrustedResourceUrlString(), ContentKind.TRUSTED_RESOURCE_URI);
  }
408410
public static String escapeHtmlAttribute(SoyValue value) {
    value = normalizeNull(value);
    if (isSanitizedContentOfKind(value, SanitizedContent.ContentKind.HTML)) {
      // |escapeHtmlAttribute should only be used on attribute values that cannot have tags.
      return stripHtmlTags(value.coerceToString(), null, true);
    }
    return escapeHtmlAttribute(value.coerceToString());
  }
1170430
public static String normalizeHtml(SoyValue value) {
    value = normalizeNull(value);
    return normalizeHtml(value.coerceToString());
  }