We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
When the title of a tab contains certain HTML elements, such as <textarea>, viewing the group in the popup can fail with a spinning gear.
Steps to reproduce:
Traceback:
Uncaught (in promise) TypeError: can't access property "addEventListener", node.querySelector(...) is null tabNodes moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/js/Frame.js:111 getRenderedTabList moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/js/Frame.js:77 _renderTabList moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/js/GroupDetailFrame.js:140 render moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/js/GroupDetailFrame.js:16 _renderGroupListItem moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/js/GroupsFrame.js:227 _renderGroupListItem moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/js/GroupsFrame.js:226 _renderGroupList moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/js/GroupsFrame.js:150 render moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/js/GroupsFrame.js:14 PopupView moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/index.js:19 PopupView moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/index.js:22 <anonymous> moz-extension://ada9b373-b62e-45a0-a5f0-02ddfa830e88/popup-view/index.js:11
This is almost certainly caused by failing to escape HTML in the title in the following code:
const node = getElementNodeFromString(` <li data-tab="${Tab.id}" class="list__item list__item--tab ${ isActive ? "list__item--highlight" : "" }" data-nav-row> <button class="list__link" title="${Tab.title} ${Tab.url}"> <img class="tab__icon" src="${Tab.favIconUrl}" width="16" height="16" alt="" /> <span>${Tab.title}</span> </button> <button class="list__close" title="${browser.i18n.getMessage("closeTab")}" ${options.hideCloseButton ? "hidden" : ""}></button> </li> `);
The text was updated successfully, but these errors were encountered:
Fix projectdelphai#276: Remove HTML injection from tab title
e871152
8eefe9e
20b2ff8
No branches or pull requests
When the title of a tab contains certain HTML elements, such as <textarea>, viewing the group in the popup can fail with a spinning gear.
Steps to reproduce:
Traceback:
This is almost certainly caused by failing to escape HTML in the title in the following code:
The text was updated successfully, but these errors were encountered: