Merge pull request #31225 from stasm/1190038-sanitize-all-html

Bug 1190038 - Sanitize all HTML elements. r=gandalf
mozilla-b2g · Aug 4, 2015 · 65c731f · 65c731f
2 parents 23e2e11 + 3837cfa
commit 65c731f
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 19 deletions.
diff --git a/apps/sharedtest/test/unit/l10n/bindings/overlay_test.js b/apps/sharedtest/test/unit/l10n/bindings/overlay_test.js
@@ -23,6 +23,7 @@ var strings = {
    'filter-href = Read <a href="#B">more</a>.',
    'filter-input-value = <input value="Other value">',
    'filter-input-type = <input type="submit" value="Submit"> the form.',
+   'filter-nested-button = <em>No <button>button</button>.</em>',
   ],
  'lang2': [
     'struct-a = Czytaj <a>więcej</a>.'
@@ -230,6 +231,15 @@ suite('L10n DOM overlays', function() {
         '<input placeholder="INPUT" type="text"> the form.');
     });
 
+    test('nested button is not allowed', function() {
+      elem.innerHTML = '';
+      navigator.mozL10n.setAttributes(elem, 'filter-nested-button');
+      navigator.mozL10n.translateFragment(elem);
+      assert.equal(
+        elem.innerHTML,
+        '<em>No button.</em>');
+    });
+
   });
 
   suite('Language change', function() {

diff --git a/build/l10n/l20n.js b/build/l10n/l20n.js
@@ -543,12 +543,9 @@ module.exports =
 	    }
 
 	    if (isElementAllowed(childElement)) {
-	      for (k = 0, attr; attr = childElement.attributes[k]; k++) {
-	        if (!isAttrAllowed(attr, childElement)) {
-	          childElement.removeAttribute(attr.name);
-	        }
-	      }
-	      result.appendChild(childElement);
+	      var sanitizedChild = childElement.ownerDocument.createElement(childElement.nodeName);
+	      overlayElement(sanitizedChild, childElement);
+	      result.appendChild(sanitizedChild);
 	      continue;
 	    }
 

diff --git a/shared/js/l10n.js b/shared/js/l10n.js
@@ -2009,12 +2009,10 @@
       }
 
       if (isElementAllowed(childElement)) {
-        for (k = 0, attr; (attr = childElement.attributes[k]); k++) {
-          if (!isAttrAllowed(attr, childElement)) {
-            childElement.removeAttribute(attr.name);
-          }
-        }
-        result.appendChild(childElement);
+        const sanitizedChild = childElement.ownerDocument.createElement(
+          childElement.nodeName);
+        overlayElement(sanitizedChild, childElement);
+        result.appendChild(sanitizedChild);
         continue;
       }
 

diff --git a/shared/js/l20n.js b/shared/js/l20n.js
@@ -266,13 +266,9 @@
         }
 
         if (isElementAllowed(childElement)) {
-          for (k = 0, attr; attr = childElement.attributes[k]; k++) {
-            if (!isAttrAllowed(attr, childElement)) {
-              childElement.removeAttribute(attr.name);
-            }
-          }
-
-          result.appendChild(childElement);
+          const sanitizedChild = childElement.ownerDocument.createElement(childElement.nodeName);
+          overlayElement(sanitizedChild, childElement);
+          result.appendChild(sanitizedChild);
           continue;
         }