New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DOM Node Creation/Modification Security #5

Closed

Step7750 opened this issue Jan 30, 2017 · 0 comments

Labels

bug

Member

Step7750 commented Jan 30, 2017

The extension failed to pass Mozilla's review process, due to the following reason:

This add-on is creating DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML, jQuery.html, or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en/XUL_School/DOM_Building_and_HTML_Insertion . Here are some examples that were discovered: float.js#L53, 90

Once #4 is merged, I'll start work on a fix.

Step7750 changed the title ~~DOM Node Creation Security~~ DOM Node Creation/Modification Security

Step7750 mentioned this issue

Eliminates Use of innerHTML #6

Merged

bmwalters added the bug label

Step7750 closed this as completed in #6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment