I realized that there is no check to call callbacks which may run script. For example, `HTMLEditor::CreateAndInsertElement` calls `aInitializer` which may run script. However, you can change this call: ``` rv = aInitializer(*this, *newElement, aPointToInsert); ``` to: ``` HTMLEditor* self = this; rv = aInitializer(*self, *newElement, aPointToInsert); ``` I think that the argument should be able to marked as "can-run-script" or should assume that any callbacks of `MOZ_CAN_RUN_SCRIPT` methods are dangerous. And "can-run-script" lambdas should be acceptable by "can-run-script" methods.
Bug 1763520 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I realized that there is no check to call callbacks which may run script. For example, `HTMLEditor::CreateAndInsertElement` calls `aInitializer` which may run script. However, you can change t[his call](https://searchfox.org/mozilla-central/rev/82946eb5e7d1234f3218310e7bc8a394666dbda5/editor/libeditor/HTMLEditor.cpp#3006): ``` rv = aInitializer(*this, *newElement, aPointToInsert); ``` to: ``` HTMLEditor* self = this; rv = aInitializer(*self, *newElement, aPointToInsert); ``` I think that the argument should be able to marked as "can-run-script" or should assume that any callbacks of `MOZ_CAN_RUN_SCRIPT` methods are dangerous. And "can-run-script" lambdas should be acceptable by "can-run-script" methods.