function sanitizeAttribs(
      tagName, attribs, opt_naiveUriRewriter, opt_nmTokenPolicy) {
    for (var i = 0; i < attribs.length; i += 2) {
      var attribName = attribs[i];
      var value = attribs[i + 1];
      var atype = null, attribKey;
      if ((attribKey = tagName + '::' + attribName,
           html4.ATTRIBS.hasOwnProperty(attribKey)) ||
          (attribKey = '*::' + attribName,
           html4.ATTRIBS.hasOwnProperty(attribKey))) {
        atype = html4.ATTRIBS[attribKey];
      }
      if (atype !== null) {
        switch (atype) {
          case html4.atype.NONE: break;
          case html4.atype.SCRIPT:
            value = null;
            break;
          case html4.atype.STYLE:
            if ('undefined' === typeof parseCssDeclarations) {
              value = null;
              break;
            }
            var sanitizedDeclarations = [];
            parseCssDeclarations(
                value,
                {
                  declaration: function (property, tokens) {
                    var normProp = property.toLowerCase();
                    var schema = cssSchema[normProp];
                    if (!schema) {
                      return;
                    }
                    sanitizeCssProperty(
                        normProp, schema, tokens,
                        opt_naiveUriRewriter);
                    sanitizedDeclarations.push(property + ': ' + tokens.join(' '));
                  }
                });
            value = sanitizedDeclarations.length > 0 ? sanitizedDeclarations.join(' ; ') : null;
            break;
          case html4.atype.ID:
          case html4.atype.IDREF:
          case html4.atype.IDREFS:
          case html4.atype.GLOBAL_NAME:
          case html4.atype.LOCAL_NAME:
          case html4.atype.CLASSES:
            value = opt_nmTokenPolicy ? opt_nmTokenPolicy(value) : value;
            break;
          case html4.atype.URI:
            value = safeUri(value, opt_naiveUriRewriter);
            break;
          case html4.atype.URI_FRAGMENT:
            if (value && '#' === value.charAt(0)) {
              value = value.substring(1);  // remove the leading '#'
              value = opt_nmTokenPolicy ? opt_nmTokenPolicy(value) : value;
              if (value !== null && value !== void 0) {
                value = '#' + value;  // restore the leading '#'
              }
            } else {
              value = null;
            }
            break;
          default:
            value = null;
            break;
        }
      } else {
        value = null;
      }
      attribs[i + 1] = value;
    }
    return attribs;
  }
/**
   * Sanitizes attributes on an HTML tag.
   * @param {string} tagName An HTML tag name in lowercase.
   * @param {Array.<?string>} attribs An array of alternating names and values.
   * @param {?function(?string): ?string} opt_naiveUriRewriter A transform to
   *     apply to URI attributes; it can return a new string value, or null to
   *     delete the attribute.  If unspecified, URI attributes are deleted.
   * @param {function(?string): ?string} opt_nmTokenPolicy A transform to apply
   *     to attributes containing HTML names, element IDs, and space-separated
   *     lists of classes; it can return a new string value, or null to delete
   *     the attribute.  If unspecified, these attributes are kept unchanged.
   * @return {Array.<?string>} The sanitized attributes as a list of alternating
   *     names and values, where a null value means to omit the attribute.
   */
Sanitizes attributes on an HTML tag.
@param {string} tagName An HTML tag name in lowercase.
@param {Array.} attribs An array of alternating names and values.
@param {?function(?string): ?string} opt_naiveUriRewriter A transform to
apply to URI attributes; it can return a new string value, or null to
delete the attribute.  If unspecified, URI attributes are deleted.
@param {function(?string): ?string} opt_nmTokenPolicy A transform to apply
to attributes containing HTML names, element IDs, and space-separated
lists of classes; it can return a new string value, or null to delete
the attribute.  If unspecified, these attributes are kept unchanged.
@return {Array.} The sanitized attributes as a list of alternating
names and values, where a null value means to omit the attribute.
Sanitizes attributes on an HTML tag . @param { string } tagName An HTML tag name in lowercase . @param { Array . } attribs An array of alternating names and values . @param { ?function ( ?string ) : ?string } opt_naiveUriRewriter A transform to apply to URI attributes ; it can return a new string value or null to delete the attribute . If unspecified URI attributes are deleted . @param { function ( ?string ) : ?string } opt_nmTokenPolicy A transform to apply to attributes containing HTML names element IDs and space - separated lists of classes ; it can return a new string value or null to delete the attribute . If unspecified these attributes are kept unchanged . @return { Array . } The sanitized attributes as a list of alternating names and values where a null value means to omit the attribute .
function sanitizeAttribs(
      tagName, attribs, opt_naiveUriRewriter, opt_nmTokenPolicy) {
    for (var i = 0; i < attribs.length; i += 2) {
      var attribName = attribs[i];
      var value = attribs[i + 1];
      var atype = null, attribKey;
      if ((attribKey = tagName + '::' + attribName,
           html4.ATTRIBS.hasOwnProperty(attribKey)) ||
          (attribKey = '*::' + attribName,
           html4.ATTRIBS.hasOwnProperty(attribKey))) {
        atype = html4.ATTRIBS[attribKey];
      }
      if (atype !== null) {
        switch (atype) {
          case html4.atype.NONE: break;
          case html4.atype.SCRIPT:
            value = null;
            break;
          case html4.atype.STYLE:
            if ('undefined' === typeof parseCssDeclarations) {
              value = null;
              break;
            }
            var sanitizedDeclarations = [];
            parseCssDeclarations(
                value,
                {
                  declaration: function (property, tokens) {
                    var normProp = property.toLowerCase();
                    var schema = cssSchema[normProp];
                    if (!schema) {
                      return;
                    }
                    sanitizeCssProperty(
                        normProp, schema, tokens,
                        opt_naiveUriRewriter);
                    sanitizedDeclarations.push(property + ': ' + tokens.join(' '));
                  }
                });
            value = sanitizedDeclarations.length > 0 ? sanitizedDeclarations.join(' ; ') : null;
            break;
          case html4.atype.ID:
          case html4.atype.IDREF:
          case html4.atype.IDREFS:
          case html4.atype.GLOBAL_NAME:
          case html4.atype.LOCAL_NAME:
          case html4.atype.CLASSES:
            value = opt_nmTokenPolicy ? opt_nmTokenPolicy(value) : value;
            break;
          case html4.atype.URI:
            value = safeUri(value, opt_naiveUriRewriter);
            break;
          case html4.atype.URI_FRAGMENT:
            if (value && '#' === value.charAt(0)) {
              value = value.substring(1);  
              value = opt_nmTokenPolicy ? opt_nmTokenPolicy(value) : value;
              if (value !== null && value !== void 0) {
                value = '#' + value;  
              }
            } else {
              value = null;
            }
            break;
          default:
            value = null;
            break;
        }
      } else {
        value = null;
      }
      attribs[i + 1] = value;
    }
    return attribs;
  }
function sanitizeAttribs ( tagName , attribs , opt_naiveUriRewriter , opt_nmTokenPolicy ) { for ( var i = 0 ; i < attribs . length ; i += 2 ) { var attribName = attribs [ i ] ; var value = attribs [ i + 1 ] ; var atype = null , attribKey ; if ( ( attribKey = tagName + '::' + attribName , html4 . ATTRIBS . hasOwnProperty ( attribKey ) ) || ( attribKey = '*::' + attribName , html4 . ATTRIBS . hasOwnProperty ( attribKey ) ) ) { atype = html4 . ATTRIBS [ attribKey ] ; } if ( atype !== null ) { switch ( atype ) { case html4 . atype . NONE : break ; case html4 . atype . SCRIPT : value = null ; break ; case html4 . atype . STYLE : if ( 'undefined' === typeof parseCssDeclarations ) { value = null ; break ; } var sanitizedDeclarations = [ ] ; parseCssDeclarations ( value , { declaration : function ( property , tokens ) { var normProp = property . toLowerCase ( ) ; var schema = cssSchema [ normProp ] ; if ( ! schema ) { return ; } sanitizeCssProperty ( normProp , schema , tokens , opt_naiveUriRewriter ) ; sanitizedDeclarations . push ( property + ': ' + tokens . join ( ' ' ) ) ; } } ) ; value = sanitizedDeclarations . length > 0 ? sanitizedDeclarations . join ( ' ; ' ) : null ; break ; case html4 . atype . ID : case html4 . atype . IDREF : case html4 . atype . IDREFS : case html4 . atype . GLOBAL_NAME : case html4 . atype . LOCAL_NAME : case html4 . atype . CLASSES : value = opt_nmTokenPolicy ? opt_nmTokenPolicy ( value ) : value ; break ; case html4 . atype . URI : value = safeUri ( value , opt_naiveUriRewriter ) ; break ; case html4 . atype . URI_FRAGMENT : if ( value && '#' === value . charAt ( 0 ) ) { value = value . substring ( 1 ) ; value = opt_nmTokenPolicy ? opt_nmTokenPolicy ( value ) : value ; if ( value !== null && value !== void 0 ) { value = '#' + value ; } } else { value = null ; } break ; default : value = null ; break ; } } else { value = null ; } attribs [ i + 1 ] = value ; } return attribs ; }
Sanitizes attributes on an HTML tag.
Sanitizes attributes on an HTML tag .
// remove the leading '#' // restore the leading '#'