Add a very basic JS injection attack document & test
Add getElementsByTagName to DomUtils.
Remove dangerous <script/> and <style/> tags before inserting XML into the dom.
<script/> tags are executed when inserted into the DOM. This is unwanted, so they are are removed before the XML is inserted into the DOM.
In addition, <style/> elements can be used to execute code, so they are removed too.
Remove event handler attributes: attributes that have no namespace and a name starting with on.
Add tests to check if dangerous input is loaded without executing javascript.
Harmonize licenses.
Fix whitespace.
Adapt test to new Async API.
Merge pull request #402 from vandenoever/noscript

Remove <script/> tags before inserting XML into the dom.
Fix wrongly displayed style information of selected images.

DirectFormattingController reads only the styling on text nodes
within the selected range. This causes wrong style information
to be communicated via signalling when the selection is an image.

This commit changes this behavior to read the style info of all
character/text elements and text nodes in the selection.

Fixes the issue where all direct and paragraph style buttons
are toggled to 'on'.
Do not disable paragraph alignment buttons on image selection.
Merge pull request #631 from adityab/region-style-signal

Fix wrong behavior of paragraph alignment buttons
Add a register method to EventNotifier,
so we can add more events later to the
same instance.
Add a SessionConstraints class to gui.

This is intended to hold the on/off states of
various constraints, allow registering new
ones, and provide subscription to a constraint's
state.
Add a constraint to disallow deleting others' annotations.

This introduces SessionConstraints into SessionController
and AnnotationController. The latter comes with a new
permission, namely "edit.annotations.onlyDeleteOwn".

Code is added into AnnotationController to check
for the author name of the annotation node to be deleted,
and do nothing if it matches the name of the current
user.
Introduce "Review Mode".

Let DirectFormattingController obey this "edit.reviewMode"
constraint by not creating any operations or processing any
action to format text when the cursor is not within the local
user's annotation.

Signals are exposed to toolbar widgets so they may
enable/disable themselves on the fly depending on the cursor
context.
Add a new gui.SessionContextCache convenience class.

It lazily computes required information and caches it
for further use -- an initial method inside it is
isLocalCursorWithinOwnAnnotation, which contains the logic
moved from DirectFormattingController. It would have been
expensive to perform this check separately everytime the
cursor moves in each controller.
Make hyperlink editing respect review mode constraints.
Move image insertion code from EditorSession to ImageInserter.

This allows access to controllers directly in the widget, as is
the convention.
Make image insertion respect review mode constraints.