Use uri.js in html-sanitizer and caja uri policies

Changes the uriPolicy api to use uri.js and passes parsed URIs to policy functions.

This addresses potential vulnerabilities arising from differences between how browsers
parse urls that are malformed.

Added URI tests from WebKit but further normalization of URI domains are needed before
these tests can be run correctly.

@5288

[ihab.awad, 2013-01-22 19:04:51]

https://codereview.appspot.com/7173043/diff/1/src/com/google/caja/plugin/doma...
File src/com/google/caja/plugin/domado.js (right):

https://codereview.appspot.com/7173043/diff/1/src/com/google/caja/plugin/doma...
src/com/google/caja/plugin/domado.js:93: console.log('Rejecting url ' + uri + '
because ' + e);
Function name is general but error message is specific, consider maybe a trivial
refactor to avoid confusion?

https://codereview.appspot.com/7173043/diff/1/src/com/google/caja/plugin/doma...
src/com/google/caja/plugin/domado.js:98: function callWithParsedUri(parsed, cb)
{
Unused.

https://codereview.appspot.com/7173043/diff/1/src/com/google/caja/plugin/doma...
src/com/google/caja/plugin/domado.js:116: return;
Should call callback here too?

https://codereview.appspot.com/7173043/diff/1/tests/com/google/caja/plugin/ur...
File tests/com/google/caja/plugin/uri_test.js (right):

https://codereview.appspot.com/7173043/diff/1/tests/com/google/caja/plugin/ur...
tests/com/google/caja/plugin/uri_test.js:647:
jsunitRegister("testWeirdDomainsDontChangeScheme", function testWeirdSchemes() {
Per discussion, to be refactored.

[ihab.awad, 2013-01-22 19:05:00]

lgtm++

[Jasvir, 2013-01-22 19:08:54]

Changes the uriPolicy api to use uri.js and passes parsed URIs to policy
functions.

This addresses potential vulnerabilities arising from differences between how
browsers
parse urls that are malformed.

Added URI tests from WebKit but further normalization of URI domains are needed
before
these tests can be run correctly.

[Jasvir, 2013-01-22 19:23:06]

Changes the uriPolicy api to use uri.js and passes parsed URIs to policy
functions.

This addresses potential vulnerabilities arising from differences between how
browsers
parse urls that are malformed.

Added URI tests from WebKit but further normalization of URI domains are needed
before
these tests can be run correctly.

[Jasvir, 2013-01-22 20:14:08]

Changes the uriPolicy api to use uri.js and passes parsed URIs to policy
functions.

This addresses potential vulnerabilities arising from differences between how
browsers
parse urls that are malformed.

Added URI tests from WebKit but further normalization of URI domains are needed
before
these tests can be run correctly.

[felix8a, 2013-01-23 21:20:12]

https://codereview.appspot.com/7173043/diff/13001/src/com/google/caja/plugin/...
File src/com/google/caja/plugin/domado.js (right):

https://codereview.appspot.com/7173043/diff/13001/src/com/google/caja/plugin/...
src/com/google/caja/plugin/domado.js:101: naiveUriPolicy.fetch(undefined, mime,
callback);
naiveUriPolicy.fetch is not a function here.  what is this supposed to do?

[Jasvir, 2013-01-23 21:24:48]

Changes the uriPolicy api to use uri.js and passes parsed URIs to policy
functions.

This addresses potential vulnerabilities arising from differences between how
browsers
parse urls that are malformed.

Added URI tests from WebKit but further normalization of URI domains are needed
before
these tests can be run correctly.

[Jasvir, 2013-01-23 21:25:33]

https://codereview.appspot.com/7173043/diff/13001/src/com/google/caja/plugin/...
File src/com/google/caja/plugin/domado.js (right):

https://codereview.appspot.com/7173043/diff/13001/src/com/google/caja/plugin/...
src/com/google/caja/plugin/domado.js:101: naiveUriPolicy.fetch(undefined, mime,
callback);
Removed.

[kpreid2, 2013-01-23 21:31:01]

https://codereview.appspot.com/7173043/diff/16001/src/com/google/caja/plugin/...
File src/com/google/caja/plugin/domado.js (right):

https://codereview.appspot.com/7173043/diff/16001/src/com/google/caja/plugin/...
src/com/google/caja/plugin/domado.js:93: console.log('Rejecting url ' + uri + '
because ' + e);
Write ' because', e (separate args to log) instead so as to permit inspection of
the error object.

[Jasvir, 2013-01-23 21:54:09]

https://codereview.appspot.com/7173043/diff/16001/src/com/google/caja/plugin/...
File src/com/google/caja/plugin/domado.js (right):

https://codereview.appspot.com/7173043/diff/16001/src/com/google/caja/plugin/...
src/com/google/caja/plugin/domado.js:93: console.log('Rejecting url ' + uri + '
because ' + e);
I was staying consistent with other console.log message calls in this file.

[kpreid2, 2013-01-23 21:55:28]

https://codereview.appspot.com/7173043/diff/16001/src/com/google/caja/plugin/...
File src/com/google/caja/plugin/domado.js (right):

https://codereview.appspot.com/7173043/diff/16001/src/com/google/caja/plugin/...
src/com/google/caja/plugin/domado.js:93: console.log('Rejecting url ' + uri + '
because ' + e);
On 2013/01/23 21:54:09, Jasvir wrote:
> I was staying consistent with other console.log message calls in this file.

Then those should be changed too, eventually.