allow multiple css pseudo-selectors

The javascript css sanitizer doesn't allow multiple pseudo-selectors,
for no particular reason. This fixes it.

This fixes issue 1873
https://code.google.com/p/google-caja/issues/detail?id=1873

[felix8a, 2013-11-21 23:34:02]

The javascript css sanitizer doesn't allow multiple pseudo-selectors,
for no particular reason. This fixes it.

This fixes issue 1873
https://code.google.com/p/google-caja/issues/detail?id=1873

[kpreid2, 2013-11-21 23:36:15]

LGTM

https://codereview.appspot.com/30570043/diff/1/src/com/google/caja/plugin/san...
File src/com/google/caja/plugin/sanitizecss.js (right):

https://codereview.appspot.com/30570043/diff/1/src/com/google/caja/plugin/san...
src/com/google/caja/plugin/sanitizecss.js:643:
HISTORY_NON_SENSITIVE_PSEUDO_SELECTOR_WHITELIST.test(tok)) {
fix while we're at it: continuation line should be four-space indented

https://codereview.appspot.com/30570043/diff/1/src/com/google/caja/plugin/san...
src/com/google/caja/plugin/sanitizecss.js:644: historySensitive =
historySensitive || false;
This doesn't seem worth keeping around. If you want to point out that we're not
setting it to true in this branch, maybe just a comment?

[felix8a, 2013-11-22 02:16:27]

@r5636

https://codereview.appspot.com/30570043/diff/1/src/com/google/caja/plugin/san...
File src/com/google/caja/plugin/sanitizecss.js (right):

https://codereview.appspot.com/30570043/diff/1/src/com/google/caja/plugin/san...
src/com/google/caja/plugin/sanitizecss.js:643:
HISTORY_NON_SENSITIVE_PSEUDO_SELECTOR_WHITELIST.test(tok)) {
On 2013/11/21 23:36:15, kpreid2 wrote:
> fix while we're at it: continuation line should be four-space indented

Done.

https://codereview.appspot.com/30570043/diff/1/src/com/google/caja/plugin/san...
src/com/google/caja/plugin/sanitizecss.js:644: historySensitive =
historySensitive || false;
On 2013/11/21 23:36:15, kpreid2 wrote:
> This doesn't seem worth keeping around. If you want to point out that we're
not
> setting it to true in this branch, maybe just a comment?

yeah I noticed that and deleted it slightly before you submitted review, heh.

I'm thinking of deleting all the historysensitive code in a separate CL, since
it's unnecessary in all the browsers we support

[kpreid2, 2013-11-22 02:50:51]

https://codereview.appspot.com/30570043/diff/1/src/com/google/caja/plugin/san...
File src/com/google/caja/plugin/sanitizecss.js (right):

https://codereview.appspot.com/30570043/diff/1/src/com/google/caja/plugin/san...
src/com/google/caja/plugin/sanitizecss.js:644: historySensitive =
historySensitive || false;
On 2013/11/22 02:16:28, felix8a wrote:
> I'm thinking of deleting all the historysensitive code in a separate CL,
> since it's unnecessary in all the browsers we support

I agree that should be done. I suggest including a feature test to verify this
and warn/abort, for documenting our requirements if nothing else. (The current
page should always be 'visited', yes?)