Add acceptable ads message in FRP

html/static/js/firstRun.js

 /*
  * This file is part of Adblock Plus <http://adblockplus.org/>,
  * Copyright (C) 2006-2014 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 85 matching lines @@
 {
   return Prefs.documentation_link
               .replace(/%LINK%/g, page)
               .replace(/%LANG%/g, Utils.appLocale);
 }
 
 function initTranslations()
 {
   // Map message ID to HTML element ID
   var mapping = {
+    "aa-title": "first-run-aa-title",
+    "aa-text": "first-run-aa-text",
     "title-main": "first-run-title-install",
     "share-text1": "first-run-share1",
     "share-text2": "first-run-share2",
     "share-donate": "first-run-share2-donate",
-    "share2-connection": "first-run-share2-or",
-    "aa-title": "first-run-aa-title",
-    "aa-text": "first-run-aa-text"
+    "share2-connection": "first-run-share2-or"
   };
 
   document.title = AdblockPlus.getMessage("first-run", "first-run-title-install");
   for (var i in mapping)
   {
     var element = document.getElementById(i);
-    element.innerHTML = AdblockPlus.getMessage("first-run", mapping[i]);

[Felix Dahlke, 2014/07/24 08:04:22]

This would introduce an XSS vulnerability, I'm afraid we need to do something
more clever. We already have this logic in Firefox, see i18n.js:
https://hg.adblockplus.org/adblockplus/file/82022936e7d9/chrome/content/ui/i1...

+    setElementText(element, AdblockPlus.getMessage("first-run", mapping[i]));
   }
 }
 
 function init()
 {
   // Choose a share text variant randomly
   var variant = Math.floor(Math.random() * 2) + 1;
   var classList = document.documentElement.className.split(" ");
   classList.push("share-variant-" + variant);
   document.documentElement.className = classList.join(" ");
 
   initTranslations();
   initSocialLinks(variant);
   setLinks("aa-text", getDocLink("acceptable_ads_criteria"), "index.html");
 
   var donateLink = document.getElementById("share-donate");
   donateLink.href = getDocLink("donate") + "&variant=" + variant;
 }
 
+// Inserts i18n strings into matching elements. Any inner HTML already in the 
+// element is parsed as JSON and used as parameters to substitute into 
+// placeholders in the i18n message.
+setElementText = function(element, elementHtml)
+{
+  function processString(str, element)
+  {
+    var match = /^(.*?)<(a|strong)>(.*?)<\/\2>(.*)$/.exec(str);
+    if (match)
+    {
+      processString(match[1], element);
+
+      var e = document.createElement(match[2]);
+      processString(match[3], e);
+      element.appendChild(e);
+
+      processString(match[4], element);
+    }
+    else
+      element.appendChild(document.createTextNode(str));
+  }
+
+  while (element.lastChild)
+    element.removeChild(element.lastChild);
+  processString(elementHtml, element);
+}
+
+
 function setLinks(id)
 {
   var element = document.getElementById(id);
   if (!element)
   {
     return;
   }
 
   var links = element.getElementsByTagName("a");
 
-  for (var i = 0; i < links.length; i++)

[Felix Dahlke, 2014/07/24 08:04:22]

Please also check that |i < arguments.length - 1| here - otherwise we'll throw
an exception for translated texts that include too many links.

+  for (var i = 0; i < links.length && i < arguments.length - 1; i++)
   {
-    if (typeof arguments[i + 1] == "string")

[Felix Dahlke, 2014/07/24 08:04:22]

It'd be cleaner to put arguments[i + 1] in a temporary variable IMO.

+    var curArg = arguments[i + 1];
+    if (typeof curArg == "string")
     {
-      links[i].href = arguments[i + 1];
+      links[i].href = curArg;
       links[i].setAttribute("target", "_blank");
     }
-    else if (typeof arguments[i + 1] == "function")
+    else if (typeof curArg == "function")
     {
       links[i].href = "javascript:void(0);";
-      links[i].addEventListener("click", arguments[i + 1], false);
+      links[i].addEventListener("click", curArg, false);
     }
   }
 }
 
 window.addEventListener("load", init);