GWT SafeHtml check

_[Original issue](https://code.google.com/p/error-prone/issues/detail?id=26) created by **eaftan@google.com** on 2012-07-19 at 08:35 PM_

---

GWT has an API called "SafeHtml" that has certain documented restrictions on how you're supposed to use it, and assuming developers use it correctly they should be largely protected against XSS vulnerabilities. Using it correctly amounts to two requirements:

  1. Some methods like SafeHtmlUtils.fromSafeConstant(String) are documented as requiring a "safe" string literal as the argument. Safe is defined here as a string that correctly parses as a sequence of complete HTML tags and leaves the parser in standard HTML context. (E.g., "<b>" is okay; "<a href='" and "<script>" are not.)

  2. GWT has legacy methods like Element.setInnerHTML(String) that predate the introduction of SafeHtml APIs and subvert the protections offered, so they should be avoided in favor of the SafeHtml-variants.

My FindBugs works by recognizing the following expressions as safe:

  1. String literals that return true for com.google.gwt.safehtml.shared.SafeHtmlHostedModeUtils.isCompleHtml(String).
  2. String values returned from a call to SafeHtml.asString().
  3. A concatenation of string expressions recognized as safe (e.g., "<b> + safeHtmlValue.asString() + "</b>" is still safe).

It then warns about calls to methods like SafeHtmlUtils.fromSafeConstant(String) or Element.setInnerHTML(String) that aren't using safe arguments. Recognizing "safe" expressions this way is intentionally lenient to avoid needless code churn due to obviously safe (and incredibly common) code constructs like element.setInnerHTML("").

(It's complicated somewhat further because there are some methods that have an interface like setTextOrHTML(String text, boolean isHtml), and I further only warn on these methods if I can't statically determine the isHtml boolean argument is always false.)