diff --git a/apps/sharedtest/test/unit/l10n/bindings/overlay_test.js b/apps/sharedtest/test/unit/l10n/bindings/overlay_test.js index 8c1d9a034d9a..c078ad5a5845 100644 --- a/apps/sharedtest/test/unit/l10n/bindings/overlay_test.js +++ b/apps/sharedtest/test/unit/l10n/bindings/overlay_test.js @@ -23,6 +23,7 @@ var strings = { 'filter-href = Read more.', 'filter-input-value = ', 'filter-input-type = the form.', + 'filter-nested-button = No .', ], 'lang2': [ 'struct-a = Czytaj więcej.' @@ -230,6 +231,15 @@ suite('L10n DOM overlays', function() { ' the form.'); }); + test('nested button is not allowed', function() { + elem.innerHTML = ''; + navigator.mozL10n.setAttributes(elem, 'filter-nested-button'); + navigator.mozL10n.translateFragment(elem); + assert.equal( + elem.innerHTML, + 'No button.'); + }); + }); suite('Language change', function() { diff --git a/build/l10n/l20n.js b/build/l10n/l20n.js index 4426a14f8750..1745276db4d2 100644 --- a/build/l10n/l20n.js +++ b/build/l10n/l20n.js @@ -543,12 +543,9 @@ module.exports = } if (isElementAllowed(childElement)) { - for (k = 0, attr; attr = childElement.attributes[k]; k++) { - if (!isAttrAllowed(attr, childElement)) { - childElement.removeAttribute(attr.name); - } - } - result.appendChild(childElement); + var sanitizedChild = childElement.ownerDocument.createElement(childElement.nodeName); + overlayElement(sanitizedChild, childElement); + result.appendChild(sanitizedChild); continue; } diff --git a/shared/js/l10n.js b/shared/js/l10n.js index ad6ac466d467..40912ba7dd58 100644 --- a/shared/js/l10n.js +++ b/shared/js/l10n.js @@ -2009,12 +2009,10 @@ } if (isElementAllowed(childElement)) { - for (k = 0, attr; (attr = childElement.attributes[k]); k++) { - if (!isAttrAllowed(attr, childElement)) { - childElement.removeAttribute(attr.name); - } - } - result.appendChild(childElement); + const sanitizedChild = childElement.ownerDocument.createElement( + childElement.nodeName); + overlayElement(sanitizedChild, childElement); + result.appendChild(sanitizedChild); continue; } diff --git a/shared/js/l20n.js b/shared/js/l20n.js index 53303ce2f2de..9f3a7c7afbfb 100644 --- a/shared/js/l20n.js +++ b/shared/js/l20n.js @@ -266,13 +266,9 @@ } if (isElementAllowed(childElement)) { - for (k = 0, attr; attr = childElement.attributes[k]; k++) { - if (!isAttrAllowed(attr, childElement)) { - childElement.removeAttribute(attr.name); - } - } - - result.appendChild(childElement); + const sanitizedChild = childElement.ownerDocument.createElement(childElement.nodeName); + overlayElement(sanitizedChild, childElement); + result.appendChild(sanitizedChild); continue; }