Introducing the CSP Fixer

@devoncarew

Devon: sorry, a couple of unrelated trivial changes have crept in.

I should also add tests.

Also note that I deliberately exposed the feature only in the form of an explicit action. I didn't want to build it into the Bower install/update sequence or anything like that because it's too early and too risky.

Hm, nice tips. Ok, I'll try sourceSpans first.


On Tue, Aug 5, 2014 at 11:59 PM, John Messerly <notifications@github.com>
wrote:

> In ide/app/lib/refactor/csp_fixer.dart:
>
> > +      }
> > +
> > +      _outlineScripts();
> > +      _outlineEventHandlers();
> > +      // TODO(ussuri): Fix other known and fixable CSP violations.
> > +
> > +      // If there are any files to write, the original HTML has been altered:
> > +      // Back up the original HTML and replace it with the postprocessed one.
> > +      if (_newFiles.isNotEmpty) {
> > +        _newFiles.add(
> > +            new _FileWriter(_file.parent, _file.name + '.pre_csp', htmlText));
> > +        // NOTE: doc.outerHtml may insert previously missing parts of a standard
> > +        // HTML document. One important example is Polymer elements, which
> > +        // normally don't have <head> or <body>, but will after postprocessing.
> > +        // That doesn't affect their functionality, though, so it's ok.
> > +        _newFiles.add(
>
>  Wow, John, so html5lib is yours? Cool stuff!
>
> Hah, kind of. I did the Dart port from https://code.google.com/p/html5lib/
> (note: it moved to github). The authors of it seem to be mostly folk that
> worked on HTML5 spec and actual browser implementations, so it tends to be
> really really accurate. We're passing the ~10k tests that existed at the
> time.
>
> Did you mean for us to contribute that, or were you volunteering to do
> that yourself?
>
> Happy to review patches.
>
> Alternatively, if you suggested a reliable way to tell Polymer flavor of
> HTML from a regular one, that could be a stop-gap solution for now.
>
> Hmmm, depends what you're looking for. Anything in an HTML Import would be
> a pretty good heuristic.
>
> Another totally different approach would be to turn on source spans. Any
> nodes that are synthetic shouldn't have a source span (or it will be 0
> length). You could either write your own serializer to skip them
> (serializers are pretty simple, look in
> https://github.com/dart-lang/bleeding_edge/blob/master/dart/pkg/third_party/html5lib/lib/dom.dart
> for addOuterHtml/addInnerHtml). Or scan the tree and remove those nodes
> first.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/dart-lang/chromedeveditor/pull/3067/files#r15858630>.
>