859898 - Remove unnecessary innerHTML from Usage application

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Cost Control, defect)

Description

[Salvador de la Puente González [:salva]]

The security team points in Gaia List to remove all 'innerHTML' and use DOM manipulations and textContent when needed.

Usage uses lazy load for some HTML resources so it is not possible to strip out every 'innerHTML' but most of them can be replaced by 'textContent'.

Comment 1

[Salvador de la Puente González [:salva]]

You can look for the mail with subject 'Newsflash: Don't use innerHTML in Firefox OS!'

Comment 2

[Salvador de la Puente González [:salva]]

Attachment: All unsafe / unnecessary innerHTML

Comment 3

[Francisco Jordano [:arcturus] [:francisco]]

Comment on attachment 735925 [details]
All unsafe / unnecessary innerHTML

Some comments on github, not really related to the pr, but nice to remember.

r+ ... thanks Salva!

Comment 4

[Salvador de la Puente González [:salva]]

Let's open another bug for l10n related stuff you spotted on the patch. Thank you!

Comment 5

[Salvador de la Puente González [:salva]]

Master: 52f1125f4af3a85e72cf1b1423a5e627df86dfed

Comment 6

[Salvador de la Puente González [:salva]]

Comment on attachment 735925 [details]
All unsafe / unnecessary innerHTML

NOTE: Please see https://wiki.mozilla.org/Release_Management/B2G_Landing to better understand the B2G approval process and landings.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): several ones
User impact if declined: low (but it is a moderate security concern)
Testing completed: yes
Risk to taking this patch (and alternatives if risky): low
String or UUID changes made by this patch: none

Comment 7

[John Ford [:jhford] CET/CEST Berlin Time]

I was not able to uplift this bug to v1-train.  If this bug has dependencies which are not marked in this bug, please comment on this bug.  If this bug depends on patches that aren't approved for v1-train, we need to re-evaluate the approval.  Otherwise, if this is just a merge conflict, you might be able to resolve it with:

  git checkout v1-train
  git cherry-pick -x -m1 52f1125f4af3a85e72cf1b1423a5e627df86dfed
  <RESOLVE MERGE CONFLICTS>
  git commit

Comment 8

[Salvador de la Puente González [:salva]]

After merging bug 841294, this applies cleanly.

v1-train: 36643db6565f7b9741592b2a2c460c2527fd6057