goog.html.SafeHtml

Returns this SafeHtml's value as string.

IMPORTANT: In code where it is security relevant that an object's type is indeed SafeHtml, use SafeHtml.unwrap instead of this method. If in doubt, assume that it's security relevant. In particular, note that goog.html functions which return a goog.html type do not guarantee that the returned instance is of the right type. For example:

 var fakeSafeHtml = new String('fake');
 fakeSafeHtml.__proto__ = SafeHtml.prototype;
 var newSafeHtml = SafeHtml.htmlEscape(fakeSafeHtml);
 // newSafeHtml is just an alias for fakeSafeHtml, it's passed through by
 // SafeHtml.htmlEscape() as fakeSafeHtml
 // instanceof SafeHtml.
 

Returns a string-representation of this value.

To obtain the actual string value wrapped in a SafeHtml, use SafeHtml.unwrap.

Interface marker of the TypedString interface.

This property can be used to determine at runtime whether or not an object implements this interface. All implementations of this interface set this property to true.

Checks if the user agent supports sandboxed iframes.

Converts an arbitrary string into an HTML comment by HTML-escaping the contents and embedding the result between HTML comment markers.

Escaping is needed because Internet Explorer supports conditional comments and so may render HTML markup within comments.

Creates a new SafeHtml object by concatenating values.

Creates a SafeHtml content consisting of a tag with optional attributes and optional content.

For convenience tag names and attribute names are accepted as regular strings, instead of Const. Nevertheless, you should not pass user-controlled values to these parameters. Note that these parameters are syntactically validated at runtime, and invalid values will result in an exception.

Example usage:

SafeHtml.create('br'); SafeHtml.create('div', {'class': 'a'}); SafeHtml.create('p', {}, 'a'); SafeHtml.create('p', {}, SafeHtml.create('br'));

SafeHtml.create('span', { 'style': {'margin': '0'} });

To guarantee SafeHtml's type contract is upheld there are restrictions on attribute values and tag names.

• For attributes which contain script code (on*), a Const is required.
• For attributes which contain style (style), a SafeStyle or a SafeStyle.PropertyMap is required.
• For attributes which are interpreted as URLs (e.g. src, href) a SafeUrl, Const or string is required. If a string is passed, it will be sanitized with SafeUrl.sanitize().
• For tags which can load code or set security relevant page metadata, more specific SafeHtml.create*() functions must be used. Tags which are not supported by this function are applet, base, embed, iframe, link, math, meta, object, script, style, svg, and template.

Creates a SafeHtml representing an iframe tag.

This by default restricts the iframe as much as possible by setting the sandbox attribute to the empty string. If the iframe requires less restrictions, set the sandbox attribute as tight as possible, but do not rely on the sandbox as a security feature because it is not supported by older browsers. If a sandbox is essential to security (e.g. for third-party frames), use createSandboxIframe which checks for browser support.

Creates a SafeHtml representing a meta refresh tag.

Package-internal utility method to create SafeHtml instances.

Like create() but does not restrict which tags can be constructed.

Creates a SafeHtml representing a sandboxed iframe tag.

The sandbox attribute is enforced in its most restrictive mode, an empty string. Consequently, the security requirements for the src and srcdoc attributes are relaxed compared to SafeHtml.createIframe. This function will throw on browsers that do not support the sandbox attribute, as determined by SafeHtml.canUseSandboxIframe.

The SafeHtml returned by this function can trigger downloads with no user interaction on Chrome (though only a few, further attempts are blocked). Firefox and IE will block all downloads from the sandbox.

Creates a SafeHtml representing a script tag. Does not allow the language, src, text or type attributes to be set.

Creates a SafeHtml representing a script tag with the src attribute.

Creates a SafeHtml representing a style tag. The type attribute is set to "text/css".

Coerces an arbitrary object into a SafeHtml object.

If textOrHtml is already of type SafeHtml, the same object is returned. Otherwise, textOrHtml is coerced to string, and HTML-escaped.

Returns HTML-escaped text as a SafeHtml object.

Returns HTML-escaped text as a SafeHtml object, with newlines changed to <br>.

Returns HTML-escaped text as a SafeHtml object, with newlines changed to <br> and escaping whitespace to preserve spatial formatting. Character entity #160 is used to make it safer for XML.

Creates a new SafeHtml object by joining the parts with separator.

Creates a string with attributes to insert after tagName.

Performs a runtime check that the provided object is indeed a SafeHtml object, and returns its value.

Unwraps value as TrustedHTML if supported or as a string if not.

Verifies if the tag name is valid and if it doesn't change the context. E.g. STRONG is fine but SCRIPT throws because it changes context. See SafeHtml.create for an explanation of allowed tags.

No information.

A SafeHtml instance corresponding to the
tag.

A SafeHtml instance corresponding to the HTML doctype: "".

A SafeHtml instance corresponding to the empty string.

Whether to strip out error messages or to leave them in.

Whether the style attribute is supported. Set to false to avoid the byte weight of SafeStyle where unneeded. An error will be thrown if the style attribute is used.