New tests are appreciated!
http://codereview.appspot.com/223095/diff/1001/2007 File java/gadgets/src/main/java/org/apache/shindig/gadgets/render/SanitizingGadgetRewriter.java (right): http://codereview.appspot.com/223095/diff/1001/2007#newcode186 java/gadgets/src/main/java/org/apache/shindig/gadgets/render/SanitizingGadgetRewriter.java:186: VisitStatus status = VisitStatus.MODIFY; Please doc why status is set to MODIFY always and not just when removing attributes. It seems that the boolean removeAttr can also change attributes (not very clean...) Maybe change removeAttr to modifyAttr that return true if attribute was modified/deleted http://codereview.appspot.com/223095/diff/1001/2008 File java/gadgets/src/main/java/org/apache/shindig/gadgets/render/SanitizingProxyingLinkRewriter.java (right): http://codereview.appspot.com/223095/diff/1001/2008#newcode35 java/gadgets/src/main/java/org/apache/shindig/gadgets/render/SanitizingProxyingLinkRewriter.java:35: public class SanitizingProxyingLinkRewriter implements ProxyUriManager { Is it a rewriter or a uri manager? I think it is confusing to follow the code without naming consistency I start to like the original LinkRewriter name better then UriManager http://codereview.appspot.com/223095/diff/1001/2001 File java/gadgets/src/test/java/org/apache/shindig/gadgets/render/SanitizingGadgetRewriterTest.java (right): http://codereview.appspot.com/223095/diff/1001/2001#newcode203 java/gadgets/src/test/java/org/apache/shindig/gadgets/render/SanitizingGadgetRewriterTest.java:203: + "@import url('http://host.com/proxy?url=www.example.org%2Fwww.evil.com%2Fx.js&"; Where did the gadget=... value is gone? I thought it would be useful for statistics. http://codereview.appspot.com/223095/show
