Closed
Bug 935017
Opened 11 years ago
Closed 11 years ago
Disallowed attributes should be removed before inserting the element into the DOM
Categories
(L20n :: JS Library, defect)
L20n
JS Library
Tracking
(Not tracked)
VERIFIED
FIXED
People
(Reporter: freddy, Assigned: stas)
References
()
Details
(Keywords: sec-moderate, wsec-input)
Attachments
(1 file)
|
(deleted),
patch
|
zbraniecki
:
review+
|
Details | Diff | Splinter Review |
See https://github.com/l20n/l20n.js/blob/master/bindings/l20n/html.js#L315
> if (isElementAllowed(childElement)) {
> result.appendChild(childElement);
> for (var k = 0, attr; attr = childElement.attributes[k]; k++) {
> if (!isAttrAllowed(attr, childElement)) {
> childElement.removeAttribute(attr.name);
> }
> }
> continue;
> }
I recommend moving the `appendChild` call after the for loop. Otherwise a race condition might allow harmful tags to go through for a short time.
|
Assignee | |
Comment 1•11 years ago
|
||
Great catch, Freddy, thanks.
Gandalf, can you take a look at this simple patch?
|
||
Updated•11 years ago
|
Attachment #827417 -
Flags: review?(gandalf) → review+
|
|
Assignee | |
Comment 2•11 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•