CODEWITHSUNDEEP
securityfirefoxfirefox-addonfirefox-addon-sdkinnerhtml
Joy
Joy

Reputation: 9550

How to use `nsIParserUtils.parseFragment()` for Firefox addon

Our Firefox addon issues queries to Google at the backend (main.js), then extracts some content through xpath. For this purpose, we use innerHTML to create a document instance for xpath parsing. But when we submit this addon to Mozilla, we got rejected because:

This add-on is creating DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML, jQuery.html, or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en/XUL_School/DOM_Building_and_HTML_Insertion

Following the link provided, we tried to replace innerHTML with nsIParserUtils.parseFragment(). However, the example code:

let { Cc, Ci } = require("chrome");
function parseHTML(doc, html, allowStyle, baseURI, isXML) {
  let PARSER_UTILS = "@mozilla.org/parserutils;1";
  ...

The Cc, Ci utilities can only be used on main.js, while the function requires a document (doc) as the argument. But we could not find any examples about creating a document inside main.js, where we could not use document.implementation.createHTMLDocument("");. Because main.js is a background script, which does not have reference to the global built-in document.

I googled a lot, but still could not find any solutions. Could anybody kindly help?

Upvotes: 0

Views: 115

Answers (1)

the8472
the8472

Reputation: 43042

You probably want to use nsIDOMParser instead, which is the same as the standard DOMParser accessible in window globals except that you can use it from privileged contexts without a window object.

Although that gives you a whole document with synthesized <html> and <body> elements if you don't provide your own. If you absolutely need a fragment you can use the html5 template element to extract a fragment via domparser:

let partialHTML = "foo <b>baz</b> bar"
let frag = parser.parseFromString(`<template>${partialHTML}</template>`, 'text/html').querySelector("template").content

Upvotes: 1

Related Questions