It took me a bit more time than I initially thought but I'm happy with what I finally came up with!
Following Postel's law, we're lenient in what we're accepting as valid URIs (using the Web Addresses character set from iri-bis, initially coming from HTML5) but strict in what we produce from UriUtils.encode and UriUtils.encodeAllowEscapes. There are two code paths: one for prod mode and one for dev mode and JVM. Dev mode doesn't use JSNI then, which should speeds things up despite the more complex algorithm. I ran the SafeHtmlTemplatesTest and UriUtilsTest in all of JVM, dev mode and prod mode (all in htmlunit only though). I'm a bit tired now (it's 2AM here) so I hope I didn't break anything! ;-) http://gwt-code-reviews.appspot.com/1380806/diff/16001/user/src/com/google/gwt/safehtml/rebind/SafeHtmlTemplatesImplMethodCreator.java File user/src/com/google/gwt/safehtml/rebind/SafeHtmlTemplatesImplMethodCreator.java (right): http://gwt-code-reviews.appspot.com/1380806/diff/16001/user/src/com/google/gwt/safehtml/rebind/SafeHtmlTemplatesImplMethodCreator.java#newcode127 user/src/com/google/gwt/safehtml/rebind/SafeHtmlTemplatesImplMethodCreator.java:127: * <li>If the template parameter occurs at the start of a URI-valued On 2011/04/10 18:32:38, xtof wrote:
There probably should be an explanation about the distinction between
"start of
URL-valued attribute" and "entire URL-valued attribute"?
Done. http://gwt-code-reviews.appspot.com/1380806/diff/16001/user/src/com/google/gwt/user/client/ui/impl/ClippedImageImpl.java File user/src/com/google/gwt/user/client/ui/impl/ClippedImageImpl.java (right): http://gwt-code-reviews.appspot.com/1380806/diff/16001/user/src/com/google/gwt/user/client/ui/impl/ClippedImageImpl.java#newcode46 user/src/com/google/gwt/user/client/ui/impl/ClippedImageImpl.java:46: UriUtils.fromUntrustedString(GWT.getModuleBaseURL() + "clear.cache.gif"); On 2011/04/10 18:32:38, xtof wrote:
I think here it would actually be appropriate to use fromTrustedString
-- the
value we're passing through here is fully under the control of the
program (at
least I think that GWT.getModuleBaseURL cannot be modified from the
outside). Done.
Actually, if GWT.getModuleBaseURL() + someFile is a common idiom, it
might be
worth introducing a utility method in UriUtils that returns an
absolute URL
based at moduleBaseURL? If it's not common, it won't be worth the
clutter
though.
I think we can expect most uses of "resources within the module 'space'" to be using ClientBundle. http://gwt-code-reviews.appspot.com/1380806/ -- http://groups.google.com/group/Google-Web-Toolkit-Contributors
