Copy of Ka-Ping's html sanitizer patch.

I LGTMed this at http://codereview.appspot.com/4641064/

Issue 4641064: Factor out a replaceable tagPolicy to enable customization of the sanitizer.

This exposes a hook named 'tagPolicy' in the sanitizer so that the
sanitizer can be customized to accept or transform particular tags,
for example, to accept <iframe> tags with a specific SRC, or transform
<embed> tags into <iframe> tags.
 
makeTagPolicy, sanitizeAttribs, and sanitizeWithPolicy are factored 
out so that they can be easily reused in custom tagPolicy functions.

Submitted @4658

[Jasvir, 2011-10-31 16:25:20]

LGTM too.

[MikeSamuel, 2011-11-03 21:18:57]

On 2011/10/31 16:25:20, Jasvir wrote:
> LGTM too.

Can you take a look at the latest snapshot.   I rolled back the html-sanitizer
changes because bridal depends on escapeAttrib.

[Jasvir, 2011-11-03 21:49:22]

LGTM++

http://codereview.appspot.com/5305081/diff/4001/src/com/google/caja/plugin/ht...
File src/com/google/caja/plugin/html-sanitizer.js (right):

http://codereview.appspot.com/5305081/diff/4001/src/com/google/caja/plugin/ht...
src/com/google/caja/plugin/html-sanitizer.js:24: * \@requires html4
Why escape all the @ in comments?

http://codereview.appspot.com/5305081/diff/4001/src/com/google/caja/plugin/ht...
src/com/google/caja/plugin/html-sanitizer.js:172: return '"' + ('' +
s).replace(ampRe, '&').replace(ltRe, '<')
is it worth just calling escapeAttrib here?

http://codereview.appspot.com/5305081/diff/4001/src/com/google/caja/plugin/ht...
src/com/google/caja/plugin/html-sanitizer.js:180: * $ quoteAttrib('')
Copy and paste error

[MikeSamuel, 2011-11-03 22:05:37]

2011/11/3  <jasvir@gmail.com>:
> LGTM++
>
>
>
http://codereview.appspot.com/5305081/diff/4001/src/com/google/caja/plugin/ht...
> File src/com/google/caja/plugin/html-sanitizer.js (right):
>
>
http://codereview.appspot.com/5305081/diff/4001/src/com/google/caja/plugin/ht...
> src/com/google/caja/plugin/html-sanitizer.js:24: * \@requires html4
> Why escape all the @ in comments?

Because JSCompiler complains on them.

>
http://codereview.appspot.com/5305081/diff/4001/src/com/google/caja/plugin/ht...
> src/com/google/caja/plugin/html-sanitizer.js:172: return '"' + ('' +
> s).replace(ampRe, '&amp;').replace(ltRe, '&lt;')
> is it worth just calling escapeAttrib here?

Done.  Got rid of quoteAttrib by inlining it into call site.

>
http://codereview.appspot.com/5305081/diff/4001/src/com/google/caja/plugin/ht...
> src/com/google/caja/plugin/html-sanitizer.js:180: * $ quoteAttrib('')
> Copy and paste error

Fixed three places.

> http://codereview.appspot.com/5305081/
>