marijnh/CodeMirror — pull request #1963 by antonkovalyov (2013-11-18 23:42:17+00:00)
Title: [dialog addon] Make dialogDiv accept a detached DOM node in addition to a template string

Mozilla's sec-review for the CodeMirror went well ([bug 935694](https://bugzilla.mozilla.org/show_bug.cgi?id=935694)). One thing our security team noted is the use of innerHTML in the dialog addon ([bug 938111](https://bugzilla.mozilla.org/show_bug.cgi?id=938111)). **This is not exploitable** today but as noted in that bug, "the use of innerHTML now is a common cause of vulnerability later".

This patch makes dialogDiv function accept a detached DOM node in addition to a template string. This way you don't need to change search and other addons that depend on the dialog addon while we can modify our extensions to avoid innerHTML altogether.

I could find unit tests for the dialog addon (outside of vim tests) so I tested manually.

Example:

```javascript
var inp = document.createElement("inp");
var div = document.createElement("div");

inp.type = "text";
inp.style.width = "10em";

div.appendChild(document.createTextNode("Search: "));
div.appendChild(inp);

editor.openDialog(div, function () { /* ... */ });
```