<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 02/13/2011 04:40 AM, Jonathan Protzenko wrote:
<blockquote cite="mid:4D57D157.5000007@gmail.com" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<b>tl;dr<br>
<br>
</b>I tried to switch the main Thunderbird Conversations HTML file
to XML so that the outer conversation chrome could be localized
using entities. This played very bad with jquery-templates, and
since I'm integrating user data, such as emails, conversation
subjects, etc. etc., I have no control over the well-formedness of
these strings, and I have to make sure they are all well-formed
before injecting them into the document. I'm very afraid it'll
take weeks before all errors are ruled out. </blockquote>
<br>
It sounds like you are saying you are injecting message data into a
chrome privileged document using innerHTML without sanitizing the
data first and without a mechanism for consistently ensuring the
user data is sanitized or otherwise inert/valid. Am I interpreting
that right? (I am basing the chrome presumption off my knowledge
that you reuse the multimessage browser element which does not have
a type specified and thus is marked as chrome. I understand the
message contents to be streamed into iframes, so those bits should
be safe.)<br>
<br>
Andrew<br>
</body>
</html>