commit dfc72b77f566b3dd98f08db0e4a8e7bedcf050a1 Author: Richard Pospesel richard@torproject.org Date: Fri Apr 20 16:03:41 2018 -0700

Bug 25458: UI customization half-broken in Tor Browser 8.0a3

Fixed fallout from #25147. Some of the functionality of the UI Customize screen is dependent on setting innerHTML on divs. Since the code runs in the System context, the HTML was being sanitized and broke page functionality. The offending statements have been switched to the unsafeSetInnerHTML() method which bypasses sanitization in System context. --- browser/components/customizableui/CustomizeMode.jsm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/browser/components/customizableui/CustomizeMode.jsm b/browser/components/customizableui/CustomizeMode.jsm index 49868cdbd4a0..4c32fd867c09 100644 --- a/browser/components/customizableui/CustomizeMode.jsm +++ b/browser/components/customizableui/CustomizeMode.jsm @@ -690,13 +690,13 @@ CustomizeMode.prototype = { // Put the tip contents in the popup. let bundle = this.document.getElementById("bundle_browser"); const kLabelClass = "customization-tipPanel-link"; - messageNode.innerHTML = bundle.getFormattedString("customizeTips.tip0", [ + messageNode.unsafeSetInnerHTML(bundle.getFormattedString("customizeTips.tip0", [ "<label class="customization-tipPanel-em" value="" + bundle.getString("customizeTips.tip0.hint") + ""/>", this.document.getElementById("bundle_brand").getString("brandShortName"), "<label class="" + kLabelClass + " text-link" value="" + bundle.getString("customizeTips.tip0.learnMore") + ""/>" - ]); + ]));

messageNode.querySelector("." + kLabelClass).addEventListener("click", () => { let url = Services.urlFormatter.formatURLPref("browser.customizemode.tip0.learnMoreUrl");