1214648 - Unsafe innerHTML/outerHTML/insertAdjacentHTML usage in gaia::settings

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: Gaia::Settings, defect)

Description

[Frederik Braun [:freddy]]

Please see the hints in bug 1211384 about fixing these kinds of problems.
The Firefox OS Security team is there to help you with any kind of question that you may have. You can reach out by setting the needinfo or sec-review flag to [e-mail]

Unsafe assignment to innerHTML:
In apps/settings/js/modules/messaging.js, line 196, column 13:
> containerNode.innerHTML = html;
In apps/settings/js/panels/frame/panel.js, line 67, column 9:
> span.innerHTML = span.innerHTML.replace(/\n/g, '<br/>');
In apps/settings/js/panels/languages/languages.js, line 21, column 11:
> option.innerHTML = LanguageList.wrapBidi(lang, languages[lang]);
In apps/settings/js/panels/simcard_manager/simcard_manager.js, line 296, column 7:
> this._elements.simCardContainer.innerHTML = simItemHTMLs.join('');
In apps/settings/js/panels/simpin/simpin.js, line 80, column 7:
> this._elements.simPinContainer.innerHTML = simPinHTMLs.join('');

Comment 1

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Is this something being planned? Thanks.

Comment 2

[[e-mail]]

Thanks freddy & tim, put it in backlog so we can manage time to work on it.

Comment 3

[Frederik Braun [:freddy]]

I will stop tracking the bugs and this bug is unassigned. Closing WONTFIX.