Safely using remote HTML

Question

I have been asked to pass some html which is being sent from my server to my Firefox add-on through a function called parseHTML by a Mozilla add-on reviewer. The method in question is documented in this XUL school tutorial.

In my content script however, typeof parseHTML == "undefined". I believe this is because my add-on is built using the add-on SDK, not XUL.

It is correct that add-ons built with the SDK do not have access to this method? Is there an equivalent method in the SDK?

Answer 1

Of course this function is undefined - it isn't some globally defined helper but rather something you have to define in your code (as shown in the code example). It uses the nsIParserUtils interface that you would need to have access to. In an SDK-based extension you would use chrome authority for that:

var {Cc, Ci} = require("chrome");
var parser = Cc["@mozilla.org/parserutils;1"].getService(Ci.nsIParserUtils);
var sanitized = parser.sanitize(html, parser.SanitizerAllowStyle);

If you are in a content script then you cannot use that of course - you would need to send the HTML code to the add-on, sanitize it there and send it back to the content script. While this is an option, you might want to consider other possibilities like not using innerHTML in the first place (if all you need is setting some text on an element then textContent is a safe alternative).

Side-note: While XUL Tutorial is rather old, this particular page has only been imported into MDN a year ago - and updated regularly since that according to history. So it is current, just not meant explicitly for the Add-on SDK (like most MDN articles actually).