tecoholic/yenWikipedia-ff — Issue #4: Sanitize DOM Insertion
Author: tecoholic
Created: 2011-12-07 05:00:40+00:00
State: open
Labels: Bug

Your add-on creates DOM nodes from HTML strings containing unsanitized data, by assigning to innerHTML or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en/XUL_School/DOM_Building_and_HTML_Insertion