Markdown: optionally allow limited <iframe> tags
Allow the Gitiles administrator to set markdown.allowiframe to
a list of http:// or https:// URL prefixes that are considered
trustworthy enough to be embedded inside of iframes within the
markdown served by this Gitiles instance.
Implement a new strict parser for the <iframe> element inside of
the markdown extension, pulling out only the src, height and width
attributes. Other iframe attributes will cause the entire element
to be recognized as raw HTML and dropped by the parser and formatter.
Apply strict validation on the src attribute, dropping the iframe
if it is not acceptable.
Change-Id: I7d5decd9f0dbfa2acf1e4f59e571ac5518067d4a
7 files changed
