Implement vAPI.insertHTML

The purpose of this API is basically to satisfy AMO reviewers in the
future, since the use of innerHTML with variables (i.e., not plain text) will
be rejected without any questions.

Since this is not a problem for browsers other than Firefox, they will
use simple innerHTML assignment, however safe-parsing could be implemented
for them too.

platform/chromium/vapi-common.js

@@ -73,6 +73,12 @@ vAPI.download = function(details) {
 
 /******************************************************************************/
 
+vAPI.insertHTML = function(node, html) {
+    node.innerHTML = html;
+};
+
+/******************************************************************************/
+
 vAPI.getURL = chrome.runtime.getURL;
 
 /******************************************************************************/

platform/firefox/vapi-background.js

@@ -42,7 +42,7 @@ vAPI.firefox = true;
 // TODO: read these data from somewhere...
 vAPI.app = {
     name: 'µBlock',
-    version: '0.8.5.0'
+    version: '0.8.5.3'
 };
 
 /******************************************************************************/
@@ -59,7 +59,7 @@ vAPI.app.restart = function() {
 // List of things that needs to be destroyed when disabling the extension
 // Only functions should be added to it
 
-cleanupTasks = [];
+var cleanupTasks = [];
 
 /******************************************************************************/
 
@@ -1212,8 +1212,9 @@ vAPI.toolbarButton.onBeforeCreated = function(doc) {
     var resizePopup = function() {
         var body = iframe.contentDocument.body;
         panel.parentNode.style.maxWidth = 'none';
-        panel.style.width = iframe.style.width = body.clientWidth + 'px';
+        // Set the hegiht first, then the width for proper resising
         panel.style.height = iframe.style.height = body.clientHeight + 'px';
+        panel.style.width = iframe.style.width = body.clientWidth + 'px';
         updateTimer = null;
     };
     var onPopupReady = function() {

platform/firefox/vapi-common.js

@@ -70,6 +70,28 @@ vAPI.download = function(details) {
 
 /******************************************************************************/
 
+vAPI.insertHTML = (function() {
+    const {classes: Cc, interfaces: Ci} = Components;
+    const parser = Cc['@mozilla.org/parserutils;1'].getService(Ci.nsIParserUtils);
+    const io = Cc['@mozilla.org/network/io-service;1'].getService(Ci.nsIIOService);
+
+    return function(node, html) {
+        while ( node.firstChild ) {
+          node.removeChild(node.firstChild);
+        }
+
+        node.appendChild(parser.parseFragment(
+            html,
+            parser.SanitizerAllowStyle,
+            false,
+            io.newURI(document.baseURI, null, null),
+            document.documentElement
+        ));
+    };
+})();
+
+/******************************************************************************/
+
 vAPI.getURL = function(path) {
     return 'chrome://' + location.host + '/content/' + path.replace(/^\/+/, '');
 };

platform/firefox/vapi-popup.js

@@ -0,0 +1 @@
+/* Firefox: no platform-specific code */

platform/safari/vapi-common.js

@@ -68,6 +68,12 @@ vAPI.download = function(details) {
 
 /******************************************************************************/
 
+vAPI.insertHTML = function(node, html) {
+    node.innerHTML = html;
+};
+
+/******************************************************************************/
+
 vAPI.getURL = function(path) {
     return safari.extension.baseURI + path;
 };

src/devtool-log.html

@@ -13,6 +13,7 @@
     </div><!-- DO NOT REMOVE --><div id="content">
     <table><tbody></tbody></table>
     </div>
+<script src="js/vapi-common.js"></script>
 <script src="js/vapi-client.js"></script>
 <script src="js/udom.js"></script>
 <script src="js/devtool-log.js"></script>

src/js/devtool-log.js

@@ -104,7 +104,7 @@ var renderLogEntry = function(entry) {
     }
     tr.cells[0].textContent = entry.result.slice(3);
     tr.cells[1].textContent = entry.type;
-    tr.cells[2].innerHTML = renderURL(entry.url, entry.result);
+    vAPI.insertHTML(tr.cells[2], renderURL(entry.url, entry.result));
     tbody.insertBefore(tr, tbody.firstChild);
 };
 

src/js/udom.js

@@ -139,7 +139,7 @@ var addHTMLToList = function(list, html) {
     var cTag = matches[1];
     var pTag = pTagOfChildTag[cTag] || 'div';
     var p = document.createElement(pTag);
-    p.innerHTML = html;
+    vAPI.insertHTML(p, html);
     // Find real parent
     var c = p.querySelector(cTag);
     p = c.parentNode;
@@ -552,7 +552,7 @@ DOMList.prototype.html = function(html) {
         return i ? this.nodes[0].innerHTML : '';
     }
     while ( i-- ) {
-        this.nodes[i].innerHTML = html;
+        vAPI.insertHTML(this.nodes[i], html);
     }
     return this;
 };