SD9010 createelement_argument

[GoogleCodeExporter]

new

Original issue reported on code.google.com by luyua...@beyondsoft.com on 22 Feb 2011 at 2:57

[GoogleCodeExporter]

// The count of the hooked createElement method.
var hookedCount = 0;
// The count of the hooked createElement method that will be reported.
var exactHookedCount = 0;

Some pages use a buggy way such as
try {
  var a = document.createElement('<input name="aa" />'); // For IE
} catch(e) {
  var a = document.createElement('input');  // For non-IE
  a.setAttribute('name', 'aa');
}
to create new element. In this case, there is no compatibility issue in all
browsers.
If the script in a page throws this createElement method error, the rest of
scripts will not be executed. So if exactHookedCount is equal to
hookedCount, it means that the createElement method is not executed after
the error thrown. Then we report this issue.

Original comment by luyua...@beyondsoft.com on 2 Mar 2011 at 4:50

• Changed state: Fixed
• Added labels: False-Positive

[GoogleCodeExporter]

Mootools tries to use document.createElement('<input name=x>') to tell if the 
current browser can accept HTML String in the createElement method. So we must 
ignore the pages using Mootools.

Mootools:

var createElementAcceptsHTML;
try {
    var x = document.createElement('<input name=x>');
    createElementAcceptsHTML = (x.name == 'x');
} catch(e){}

Original comment by luyua...@beyondsoft.com on 23 Mar 2011 at 6:14

[GoogleCodeExporter]

Mootools URL:  
http://mootools.net/download/get/mootools-core-1.3.1-full-compat.js

Original comment by luyua...@beyondsoft.com on 23 Mar 2011 at 6:57