search

GuGuss / ARTE-7-Downloader

User script to download videos from the ARTE+7 website
GNU General Public License v3.0
263 stars 33 forks source link

Mozilla security check fails on warnings #75

Closed Bumbadawg closed 3 years ago

Bumbadawg commented 6 years ago

A Mozilla reviewer disabled the addon for the time being, as it doesn't concur to their security policy. Therefore it's a good occasion to upgrade what's causing it =)

here's an excerpt from the mail they sent me:

This version didn't pass review because of the following

issue: 1) This add-on is creating DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML, jQuery.html, or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Safely_inserting_external_content_into_a_page .

Here are some examples that were discovered: src/arte-downloader.js line 383, 370, 556 Please submit a new version and provide all requested information at your convenience.

Reviewer: Andreea Neamtiu