Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Perform light AMP validation #140

Closed
twifkak opened this issue Oct 5, 2018 · 2 comments
Closed

Perform light AMP validation #140

twifkak opened this issue Oct 5, 2018 · 2 comments

Comments

@twifkak
Copy link
Member

twifkak commented Oct 5, 2018

Transforms may have unintended effects on invalid documents. There may be cases where the SXG is fetched and served by third parties without validation. Since full validation at serve time is too expensive, it should perform some light validation; at least to verify that the document intends to be AMP.

@twifkak twifkak added this to the v2: Support b2 format milestone Oct 5, 2018
@Gregable
Copy link
Member

Gregable commented Oct 5, 2018

Knowing the transforms that run, I doubt any of the transforms would make an invalid amp document particularly dangerous. Hard to guarantee that's the case, but most of them just exist to make the document less likely to behave in non-amp manners, such as executing javascript.

An additional idea would be to add a transformer that strips a handful of known disallowed HTML, such as extra attention to script tags and stripping on* attributes. These will be no-ops on amp pages, and so should be cheap to run.

@twifkak
Copy link
Member Author

twifkak commented Oct 8, 2018

@Gregable's suggestion has been split into #148.

twifkak added a commit that referenced this issue Oct 9, 2018
…orms. This

is done as a transformer rather than in amphtml.NewDOM because it applies only
for the packager, and not other uses of the transformer library. In particular,
doing this in amphtml.NewDOM breaks ampBoilerplate_test.go because of amp4ads
and amp4email.

Fixes #140.

PiperOrigin-RevId: 216250217
twifkak added a commit that referenced this issue Oct 9, 2018
…orms. This

is done as a transformer rather than in amphtml.NewDOM because it applies only
for the packager, and not other uses of the transformer library. In particular,
doing this in amphtml.NewDOM breaks ampBoilerplate_test.go because of amp4ads
and amp4email.

Fixes #140.

PiperOrigin-RevId: 216250217
@twifkak twifkak closed this as completed in 1a05d9d Oct 9, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants