public static enum Context.UriType extends Enum<Context.UriType>
This distinguishes between the types of URI safety concerns, which vary between images, scripts, and other types.
| Enum Constant and Description |
|---|
MEDIA
Image URL type.
|
NONE
Not in or about to be in a URI.
|
NORMAL
General URI context suitable for most URI types.
|
TRUSTED_RESOURCE
A URI which loads resources.
|
TRUSTED_RESOURCE_BLOCK
Same as
TRUSTED_RESOURCE but with slightly different semantics. |
| Modifier and Type | Method and Description |
|---|---|
static Context.UriType |
valueOf(String name)
Returns the enum constant of this type with the specified name.
|
static Context.UriType[] |
values()
Returns an array containing the constants of this enum type, in
the order they are declared.
|
public static final Context.UriType NONE
Note the URI type can be set even if we haven't entered the URI itself yet.
public static final Context.UriType NORMAL
The biggest use-case here is for anchors, where we want to prevent Javascript URLs that can cause XSS. However, this grabs other types of URIs such as stylesheets, prefetch, SEO metadata, and attributes that look like they're supposed to contain URIs but might just be harmless metadata because they end with "url".
It's expected that this will be split up over time to address the different safety levels of the different URI types.
public static final Context.UriType MEDIA
Here, we can relax some some rules. For example, a data URI in an image is unlikely to do anything that loading an image from a 3rd party http/https site.
At present, note that Soy doesn't do anything to prevent referer[r]er leakage. At some future point, we may want to provide configuration options to avoid 3rd party or http-in-the-clear image loading.
In the future, this might also encompass video and audio, if we can find ways to reduce the risk of social engineering.
public static final Context.UriType TRUSTED_RESOURCE
public static final Context.UriType TRUSTED_RESOURCE_BLOCK
TRUSTED_RESOURCE but with slightly different semantics.
This is applied to kind="trusted_resource_uri" blocks/templates and it changes the
semantics for composing a trusted resource uri.
These semantics are not compatible with the current TRUSTED_RESOURCE because that
mode requires every part to be a trusted_resource_uri even though concatenating multiple such
URIs is not obviously safe.
TODO(b/72493024): apply these same, superior semantics to TRUSTED_RESOURCE
public static Context.UriType[] values()
for (Context.UriType c : Context.UriType.values()) System.out.println(c);
public static Context.UriType valueOf(String name)
name - the name of the enum constant to be returned.IllegalArgumentException - if this enum type has no constant with the specified nameNullPointerException - if the argument is null