938111 - Purge the developer tools of innerHTML: Editor - openDialog codemirror extension

Status: RESOLVED FIXED

(DevTools :: General, defect, P2)

Description

[Mark Goodwin [:mgoodwin]]

CodeMirror manages to completely avoid use of innerHTML (yay!) but our openDialog extension doesn't. This is unfortunate as, whilst this is not exploitable at present, the use of innerHTML now is a common cause of vulnerability later.

See: https://mxr.mozilla.org/mozilla-central/source/browser/devtools/sourceeditor/codemirror/dialog/dialog.js#13

Comment 1

[Anton Kovalyov (:anton)]

Opened a pull request for the proposed change: https://github.com/marijnh/CodeMirror/pull/1963. Depending on the response, I'll either pull the latest version of CM3 into the tree or modify dialog addon and update READMEs. After that, it's super easy to update extensions that rely on this addon (only search and jump to line AFAIK).

Comment 2

[Anton Kovalyov (:anton)]

Attachment: WIP 1

This patch imports my patch to CodeMirror [1] and changes jumpToLine and search functionality to use DOM nodes instead of innerHTML. It doesn't touch replace dialogs because we don't use them.

[1] https://github.com/marijnh/CodeMirror/pull/1963

Comment 3

[Heather Arthur [:harth]]

Comment on attachment 8335581 [details] [diff] [review]
WIP 1

Review of attachment 8335581 [details] [diff] [review]:
-----------------------------------------------------------------

::: browser/devtools/sourceeditor/codemirror/search/search.js
@@ +53,5 @@
> +      let txt = doc.createTextNode(cm.l10n("findCmd.promptMessage"));
> +
> +      inp.type = "text";
> +      inp.style.width = "10em";
> +      inp.style.marginLeft = "1em";

marginLeft -> mozMarginStart

::: browser/devtools/sourceeditor/editor.js
@@ +627,5 @@
> +    let txt = doc.createTextNode(L10N.GetStringFromName("gotoLineCmd.promptTitle"));
> +
> +    inp.type = "text";
> +    inp.style.width = "10em";
> +    inp.style.marginLeft = "1em";

mozMarginStart

Comment 4

[Anton Kovalyov (:anton)]

Attachment: WIP 2

https://hg.mozilla.org/integration/fx-team/rev/5bb4635154f9

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5bb4635154f9