1
// Copyright 2014 The Closure Library Authors. All Rights Reserved.
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//      http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS-IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14

15

16
/**
17
 * @fileoverview SafeHtml factory methods for creating object and embed tags
18
 * for loading Flash files.
19
 */
20

21
goog.provide('goog.html.flash');
22

23
goog.require('goog.asserts');
24
goog.require('goog.html.SafeHtml');
25

26

27
/**
28
 * Attributes and param tag name attributes not allowed to be overriden
29
 * when calling createObject() and createObjectForOldIe().
30
 *
31
 * While values that should be specified as params are probably not
32
 * recognized as attributes, we block them anyway just to be sure.
33
 * @const {!Array<string>}
34
 * @private
35
 */
36
goog.html.flash.FORBIDDEN_ATTRS_AND_PARAMS_ON_FLASH_ = [
37
  'classid',       // Used on old IE.
38
  'data',          // Used in <object> to specify a URL.
39
  'movie',         // Used on old IE.
40
  'type',          // Used in <object> on for non-IE/modern IE.
41
  'typemustmatch'  // Always set to a fixed value.
42
];
43

44

45
goog.html.flash.createEmbed = function(src, opt_attributes) {
46
  var fixedAttributes = {
47
    'src': src,
48
    'type': 'application/x-shockwave-flash',
49
    'pluginspage': 'https://www.macromedia.com/go/getflashplayer'
50
  };
51
  var defaultAttributes = {
52
    'allownetworking': 'none',
53
    'allowscriptaccess': 'never'
54
  };
55
  var attributes = goog.html.SafeHtml.combineAttributes(
56
      fixedAttributes, defaultAttributes, opt_attributes);
57
  return goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse(
58
      'embed', attributes);
59
};
60

61

62
goog.html.flash.createObject = function(data, opt_params, opt_attributes) {
63
  goog.html.flash.verifyKeysNotInMaps(
64
      goog.html.flash.FORBIDDEN_ATTRS_AND_PARAMS_ON_FLASH_, opt_attributes,
65
      opt_params);
66

67
  var paramTags = goog.html.flash.combineParams(
68
      {'allownetworking': 'none', 'allowscriptaccess': 'never'}, opt_params);
69
  var fixedAttributes = {
70
    'data': data,
71
    'type': 'application/x-shockwave-flash',
72
    'typemustmatch': ''
73
  };
74
  var attributes =
75
      goog.html.SafeHtml.combineAttributes(fixedAttributes, {}, opt_attributes);
76

77
  return goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse(
78
      'object', attributes, paramTags);
79
};
80

81

82
goog.html.flash.createObjectForOldIe = function(
83
    movie, opt_params, opt_attributes) {
84
  goog.html.flash.verifyKeysNotInMaps(
85
      goog.html.flash.FORBIDDEN_ATTRS_AND_PARAMS_ON_FLASH_, opt_attributes,
86
      opt_params);
87

88
  var paramTags = goog.html.flash.combineParams(
89
      {'allownetworking': 'none', 'allowscriptaccess': 'never', 'movie': movie},
90
      opt_params);
91
  var fixedAttributes = {
92
    'classid': 'clsid:d27cdb6e-ae6d-11cf-96b8-444553540000'
93
  };
94
  var attributes =
95
      goog.html.SafeHtml.combineAttributes(fixedAttributes, {}, opt_attributes);
96

97
  return goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse(
98
      'object', attributes, paramTags);
99
};
100

101

102
/**
103
 * @param {!Object<string, string|!goog.string.TypedString>} defaultParams
104
 * @param {?Object<string, string>=} opt_params Optional params passed to
105
 *     create*().
106
 * @return {!Array<!goog.html.SafeHtml>} Combined params.
107
 * @throws {Error} If opt_attributes contains an attribute with the same name
108
 *     as an attribute in fixedAttributes.
109
 * @package
110
 */
111
goog.html.flash.combineParams = function(defaultParams, opt_params) {
112
  var combinedParams = {};
113
  var name;
114

115
  for (name in defaultParams) {
116
    goog.asserts.assert(name.toLowerCase() == name, 'Must be lower case');
117
    combinedParams[name] = defaultParams[name];
118
  }
119
  for (name in opt_params) {
120
    var nameLower = name.toLowerCase();
121
    if (nameLower in defaultParams) {
122
      delete combinedParams[nameLower];
123
    }
124
    combinedParams[name] = opt_params[name];
125
  }
126

127
  var paramTags = [];
128
  for (name in combinedParams) {
129
    paramTags.push(
130
        goog.html.SafeHtml.createSafeHtmlTagSecurityPrivateDoNotAccessOrElse(
131
            'param', {'name': name, 'value': combinedParams[name]}));
132
  }
133
  return paramTags;
134
};
135

136

137
/**
138
 * Checks that keys are not present as keys in maps.
139
 * @param {!Array<string>} keys Keys that must not be present, lower-case.
140
 * @param {?Object<string, ?goog.html.SafeHtml.AttributeValue>=} opt_attributes
141
 *     Optional attributes passed to create*().
142
 * @param {?Object<string, string>=}  opt_params Optional params passed to
143
 *     createObject*().
144
 * @throws {Error} If any of keys exist as a key, ignoring case, in
145
 *     opt_attributes or opt_params.
146
 * @package
147
 */
148
goog.html.flash.verifyKeysNotInMaps = function(
149
    keys, opt_attributes, opt_params) {
150
  var verifyNotInMap = function(keys, map, type) {
151
    for (var keyMap in map) {
152
      var keyMapLower = keyMap.toLowerCase();
153
      for (var i = 0; i < keys.length; i++) {
154
        var keyToCheck = keys[i];
155
        goog.asserts.assert(keyToCheck.toLowerCase() == keyToCheck);
156
        if (keyMapLower == keyToCheck) {
157
          throw Error(
158
              'Cannot override "' + keyToCheck + '" ' + type + ', got "' +
159
              keyMap + '" with value "' + map[keyMap] + '"');
160
        }
161
      }
162
    }
163
  };
164

165
  verifyNotInMap(keys, opt_attributes, 'attribute');
166
  verifyNotInMap(keys, opt_params, 'param');
167
};
168

169