Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>First the correct answer, which isn't really what you're looking for, but to important to omit:</p> <p><strong>Do not append/inject/whatever remotely retrieved HTML or javascript code into XUL or chrome code scopes!</strong></p> <p>Stuff like this always is a security vulnerability. JS is executable, and HTML may contain executable bits as well (e.g. javascript: protocol). Any injected code will run with full browser privileges, which translates to OS user privileges (which on Windows XP translates to Administrator privileges).</p> <p>You need to either escape the html, or parse it and only leave secure bits in.</p> <p>You cannot trust remote code, even if it originates from your own servers:</p> <ul> <li>Man in the middle attacks (http)</li> <li>Compromised server</li> <li>Rough server admin (not you, hopefully ;))</li> </ul> <p>BTW: Appending/injecting/whatever remotely retrieved code or HTML into chrome space will lead to rejection of the affected versions of your add-on on addons.mozilla.org for the reason stated above.</p> <p>Now the technically correct answer, but do not use with remotely retrieved and sanitized HTML:</p> <ol> <li>You need to make sure the correct HTML namespace will be used (<code>xmlns:html="http://www.w3.org/1999/xhtml"</code>)</li> <li>You cannot actually <code>appendElement()</code> text, but only real DOM elements. Hence you must parse any text into a DOM before. Easiest with valid XML (<a href="https://developer.mozilla.org/en/DOMParser" rel="nofollow">DOMParser</a>); possible for tag soup stuff via a hidden iframe.</li> <li>You should <code>adoptNode</code> any Elements from different DOMs</li> <li>Append the elements one by one then (each menuitem and subtree).</li> </ol>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload