Issue 11072062: Make sure translations can only use two HTML tags without any attributes - no custom HTML code in t…

Keyboard Shortcuts

	File
u :	up to issue
m :	publish + mail comments
M :	edit review message
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line
<Enter> :	respond to / edit current comment
d :	mark current comment as done

	Issue
u :	up to list of issues
m :	publish + mail comments
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue
# :	close issue

	Comment/message editing
<Ctrl> + s or <Ctrl> + Enter :	save comment
<Esc> :	cancel edit

Issue 11072062: Make sure translations can only use two HTML tags without any attributes - no custom HTML code in t… (Closed)

Created:
July 10, 2013, 6:50 a.m. by Wladimir Palant

Modified:
July 10, 2013, 9:41 a.m.

Reviewers:
Thomas Greiner

Visibility:
Public.

Description

The fact that we currently allow custom HTML code in Chrome translations is a bug, not a feature. The implications of a malicious translation in Chrome are limited, in Firefox it would be an outright security vulnerability however.

Patch Set 1 #

Total comments: 3

Created: July 10, 2013, 6:50 a.m.

Download [raw] [tar.bz2]

		Unified diffs	Side-by-side diffs	Delta from patch set	Stats (+30 lines, -10 lines)			Patch
	M	chrome/content/ui/i18n.js	View		2 chunks	+30 lines, -10 lines	3 comments	Download

Messages

Total messages: 4

Expand All Messages | Collapse All Messages

Thomas Greiner

LGTM one comment but not a necessary change http://codereview.adblockplus.org/11072062/diff/1/chrome/content/ui/i18n.js File chrome/content/ui/i18n.js (right): http://codereview.adblockplus.org/11072062/diff/1/chrome/content/ui/i18n.js#newcode121 chrome/content/ui/i18n.js:121: node.removeChild(node.lastChild); ...

July 10, 2013, 8:45 a.m. (2013-07-10 08:45:38 UTC) #2

Wladimir Palant

http://codereview.adblockplus.org/11072062/diff/1/chrome/content/ui/i18n.js File chrome/content/ui/i18n.js (right): http://codereview.adblockplus.org/11072062/diff/1/chrome/content/ui/i18n.js#newcode121 chrome/content/ui/i18n.js:121: node.removeChild(node.lastChild); I would rather avoid using innerHTML for anything ...

July 10, 2013, 9:07 a.m. (2013-07-10 09:07:23 UTC) #3

Thomas Greiner

July 10, 2013, 9:41 a.m. (2013-07-10 09:41:43 UTC) #4

http://codereview.adblockplus.org/11072062/diff/1/chrome/content/ui/i18n.js
File chrome/content/ui/i18n.js (right):

http://codereview.adblockplus.org/11072062/diff/1/chrome/content/ui/i18n.js#n...
chrome/content/ui/i18n.js:121: node.removeChild(node.lastChild);
I wasn't aware of that review process. I assume that's not the case for
textContent because it has the same effect if you do
node.textContent = "";

Expand All Messages | Collapse All Messages