Bug 1108: caja now allows iframe src= in static html

http://code.google.com/p/google-caja/issues/detail?id=1108
    r3652 which added support for iframe shims
    also allows iframes in static html.
    so if you cajole
      <iframe src="http://google.com">
    caja will happily emit that.
    the urlpolicy gets to rewrite the url (as mimeType=="text/html"),
    but this is new behavior.  a urlpolicy might not expect to
    handle an iframe src url, and might do the wrong thing with it.

Fixed whitelists to make sure that only the HTML attributes required
by IFRAME shims.

Added tests to TemplateSanitizer to check this going forward.

As Felix points out, we should revisit these taming decisions once we
have implemented the new URI policy which distinguishes between
immediately loaded content like
  <iframe src="//foo.com/">
and content loaded on user interaction like
  <a href="//foo.com/">


Submitted @3810
Advisory @ http://code.google.com/p/google-caja/wiki/SecurityAdvisory19Oct2009

[felix8a, 2009-09-29 20:51:28]

lgtm

http://codereview.appspot.com/124069/diff/7/1007
File src/com/google/caja/lang/html/html4-attributes-whitelist.json (right):

http://codereview.appspot.com/124069/diff/7/1007#newcode264
Line 264: { "key": "IFRAME::ID",
I'm a little confused by the types declaration without
any attributes.  is that just for the comment?

[MikeSamuel, 2009-09-29 21:18:00]

http://codereview.appspot.com/124069/diff/7/1007
File src/com/google/caja/lang/html/html4-attributes-whitelist.json (right):

http://codereview.appspot.com/124069/diff/7/1007#newcode264
Line 264: { "key": "IFRAME::ID",
On 2009/09/29 20:51:28, felix8a wrote:
> I'm a little confused by the types declaration without
> any attributes.  is that just for the comment?

Yep.  I'm creating this element so that I can deny IFRAME::ID while allowing
*::ID.

I copied the other elements, type, etc. from the *::ID definition.

[felix8a, 2009-09-29 21:22:08]

On 2009/09/29 21:18:00, MikeSamuel wrote:
> http://codereview.appspot.com/124069/diff/7/1007
> File src/com/google/caja/lang/html/html4-attributes-whitelist.json (right):
> 
> http://codereview.appspot.com/124069/diff/7/1007#newcode264
> Line 264: { "key": "IFRAME::ID",
> On 2009/09/29 20:51:28, felix8a wrote:
> > I'm a little confused by the types declaration without
> > any attributes.  is that just for the comment?
> 
> Yep.  I'm creating this element so that I can deny IFRAME::ID while allowing
> *::ID.

oh, right.  ok.