com.google.template.soy.shared.internal

Class EscapingConventions.FilterNormalizeMediaUri

java.lang.Object

com.google.common.escape.Escaper

com.google.template.soy.shared.internal.EscapingConventions.CrossLanguageStringXform

com.google.template.soy.shared.internal.EscapingConventions.FilterNormalizeMediaUri

Enclosing class:

EscapingConventions

public static final class EscapingConventions.FilterNormalizeMediaUri
extends EscapingConventions.CrossLanguageStringXform

Like EscapingConventions.FilterNormalizeUri, but also accepts data: and blob: URIs, since image sources don't execute script in the same origin as the page (although image handling 0-days are available from time to time, but a templating language can't realistically try to protect against such a thing).

Only intended to be used with images; for videos and audio we expect some sort of further review since they can more easily be used for social engineering. Video and audio still accept http/https because remote video and audio can still be protected against via CSP, but data URIs don't have self-evident provenance.

Field Summary

Fields

Modifier and Type	Field and Description
static EscapingConventions.FilterNormalizeMediaUri	INSTANCE Implements the |filterNormalizeMediaUri directive.

Method Summary

Modifier and Type	Method and Description
protected com.google.common.collect.ImmutableList<EscapingConventions.Escape>	defineEscapes() Returns the escapes used for this escaper.
String	getInnocuousOutput() Returns an innocuous string in this context that can be used when filtering.

Methods inherited from class com.google.template.soy.shared.internal.EscapingConventions.CrossLanguageStringXform

escape, escape, getDirectiveName, getEscapes, getLangFunctionNames, getNonAsciiPrefix, getValueFilter

Methods inherited from class com.google.common.escape.Escaper

asFunction

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

INSTANCE

public static final EscapingConventions.FilterNormalizeMediaUri INSTANCE

Implements the |filterNormalizeMediaUri directive.

Method Detail

defineEscapes

protected com.google.common.collect.ImmutableList<EscapingConventions.Escape> defineEscapes()

Description copied from class: EscapingConventions.CrossLanguageStringXform

Returns the escapes used for this escaper.

Specified by:

defineEscapes in class EscapingConventions.CrossLanguageStringXform

getInnocuousOutput

public String getInnocuousOutput()

Description copied from class: EscapingConventions.CrossLanguageStringXform

Returns an innocuous string in this context that can be used when filtering.

Overrides:

getInnocuousOutput in class EscapingConventions.CrossLanguageStringXform