tree fba90836e1920c37d2c04aa669eb3816ac6c3849
parent 9119b64c6f6bba5f979c89cc93ac7695efb60bfd
author Shawn Pearce <sop@google.com> 1423815181 -0800
committer Shawn Pearce <sop@google.com> 1423894898 -0800

Markdown: optionally allow limited <iframe> tags

Allow the Gitiles administrator to set markdown.allowiframe to
a list of http:// or https:// URL prefixes that are considered
trustworthy enough to be embedded inside of iframes within the
markdown served by this Gitiles instance.

Implement a new strict parser for the <iframe> element inside of
the markdown extension, pulling out only the src, height and width
attributes. Other iframe attributes will cause the entire element
to be recognized as raw HTML and dropped by the parser and formatter.

Apply strict validation on the src attribute, dropping the iframe
if it is not acceptable.

Change-Id: I7d5decd9f0dbfa2acf1e4f59e571ac5518067d4a