Add-ons/Reviewers/MiscCannedResponses: Difference between revisions

<blockquote>Your add-on creates DOM nodes with raw HTML strings containing unsanitized string data. While the recommended method of creating DOM nodes is to use JavaScript DOM building methods such as createElement and appendChild (see https://developer.mozilla.org/en/How_to_create_a_DOM_tree) or one of the libraries which simplify using this method, creating content via strings is allowed if non-static data is sanitized with a function such as the following: <br> <pre>function escapeHTML(str) str.replace(/[&amp;"&lt;&gt;]/g,  

        function (m) "&amp;" + ({ "&amp;": "amp",  

                              '"': "quot",  

                              "&lt;": "lt", "&gt;": "gt" })[m] + ";"

        );</pre></blockquote>