Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Swap innerHTML to document.createFragment for pageAction/popup #2491

Closed
wants to merge 10 commits into from

Conversation

maxxcrawford
Copy link
Collaborator

@maxxcrawford maxxcrawford commented Jan 23, 2023

Summary

When submitting to AMO, there's a warning about using innerHTML.

Blocking L10N PR: mozilla-l10n/multi-account-containers-l10n#22

This PR replaces all instances of it.

TODO:

  • Fix pageAction.js
  • Fix popup.js

Testing

This should have no visible changes in the UI. Check both the popup panel and the pageAction (in the URL bar). Both should appear/match main.

Screenshots

Confirmed with VPN set that the flag setting works/displays as expected:
image

@maxxcrawford maxxcrawford changed the title Security fix: Swap innerHTML to document.createFragment for pageAction.js Swap innerHTML to document.createFragment for pageAction.js Jan 23, 2023
@maxxcrawford maxxcrawford changed the title Swap innerHTML to document.createFragment for pageAction.js ⚠️ WIP: Swap innerHTML to document.createFragment for pageAction.js Jan 23, 2023
@maxxcrawford maxxcrawford changed the title ⚠️ WIP: Swap innerHTML to document.createFragment for pageAction.js 🚧 WIP: Swap innerHTML to document.createFragment for pageAction.js Jan 23, 2023
@maxxcrawford maxxcrawford added the Component: MozillaVPN Issues related to MozillaVPN label Jan 23, 2023
@dannycolin dannycolin linked an issue Jan 23, 2023 that may be closed by this pull request
@dannycolin
Copy link
Collaborator

@maxxcrawford What do you think of completely removing pageAction right now? See #2477.

@maxxcrawford maxxcrawford changed the title 🚧 WIP: Swap innerHTML to document.createFragment for pageAction.js 🚧 WIP: Swap innerHTML to document.createFragment for pageAction/popup Feb 13, 2023
@maxxcrawford maxxcrawford force-pushed the unsafe-innerhtml-fix branch 2 times, most recently from 3ca33f4 to ec80c78 Compare February 13, 2023 19:02
@maxxcrawford maxxcrawford changed the title 🚧 WIP: Swap innerHTML to document.createFragment for pageAction/popup Swap innerHTML to document.createFragment for pageAction/popup Feb 13, 2023
@maxxcrawford maxxcrawford marked this pull request as ready for review February 13, 2023 19:02
@dannycolin
Copy link
Collaborator

New container item is duplicated

  1. Open the popup
  2. Click on Manage Container
  3. Click on Back button
  4. Click again on Manage Container

There's now two "+ New Container" items.

You can assign about:newtab to a container

  1. Open the popup
  2. Click on "Always open this site in..."
  3. Select a container

Tab reopens in the assigned container.

  1. Reopen the popup
  2. Click on Manage Containers
  3. Choose the container you assign about:newtab to
  4. Click on Manage site list

There's an entry without a title corresponding to about:newtab

tableData.appendChild(spanMenuText);
tableRowMenuItem.appendChild(tableData);
tableMenu.appendChild(tableRowMenuItem);
divNewContainer.appendChild(tableMenu);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At L1236, we need to use divNewContainer.replaceChildren(tableMenu); to avoid creating a duplicate of the new container item everytime we enter MANAGE_CONTAINERS_PICKER panel.

@maxxcrawford
Copy link
Collaborator Author

Closing right now to stop blocking @dannycolin on other stuff.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Component: MozillaVPN Issues related to MozillaVPN
Projects
None yet
Development

Successfully merging this pull request may close these issues.

AMO Validation Warning: Unsafe assignment to innerHTML
2 participants