bufferapp/buffer-extension-shared — pull request #48 by djfarrelly (2014-12-17 19:11:52+00:00)
Title: Comply with Mozilla's add-on requirements

This addresses all of the issues raised by Mozilla when re-submitting the extension to the Add-on directory. These are all needed changes we should have done anyway. Here is the email with the detailed issues and fixes:

>1. Your add-on includes a JavaScript library file that doesn't match our checksums for known release versions (jquery-1.7.2.min.js). We require all add-ons to use unmodified release versions, obtained directly from the developer's website. You can find a list of the library versions we check for here: http://mzl.la/amo-libs. Other libraries are manually checked.

Updated jQuery and checked the hash with `shasum -a 256 path/to/your/file.js`

>2. This version contains binary, obfuscated or minified code (buffer-hotkey.js). We need to review all of your source code in order to approve it.
>You can upload the sources using the AMO Developer Hub, by selecting your latest version and looking for the source code upload field. For future reference, you can also do this when submitting new versions, which will reduce your review waiting time. If you can't provide your sources this way, you can include the information on how to obtain them in the Notes to Reviewers. In the case of obfuscated or machine-generated JavaScript, including cross-compiled code and preprocessed template code, instructions must be provided to generate the same obfuscated code in the resulting XPI.
>If sources have not been provided within 7 days, this version will be rejected and removed from our queues.
>You can read our policies regarding source code handling here: https://addons.mozilla.org/en-US/developers/docs/policies/reviews#section-binary.

This file contained a minified version of keymaster.js. This is now unminified and in a separate file.

>3. Your add-on uses the 'eval' function unnecessarily, which is something we normally don't accept. There are many reasons *not* to use 'eval', and also simple alternatives to using it. You can read more about it here: https://developer.mozilla.org/en/XUL_School/Appendix_C:_Avoid_using_eval_in_Add-ons

`eval` was being used in the **json2.js** library packaged with **postmessage.js**

>4. Your add-on creates DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en/XUL_School/DOM_Building_and_HTML_Insertion.

Switched this out for using `document.createTextNode` in **buffer-overlay.js**