Unsafe assignment to innerHTML [duplicate] - javascript

This question already has an answer here:
Best way to purge innerHTML from a Firefox Extension
(1 answer)
Closed 2 years ago.
I was trying to get an add on for Firefox signed by Mozilla so I could use it on the stable version of firefox and I'm getting this validation issue.
Can someone help me understand what it is?
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns,
this may not be set using dynamic values which have not been adequately sanitized.
This can lead to security issues or fairly serious performance degradation.
datetime.js line 4 column 5
function updateClock(){
var doc=window.content.document
var dt = new Date();
doc.getElementById("datetime").innerHTML = dt.toLocaleTimeString();
}
setInterval(updateClock, 0);

dt.toLocateTimeString() return a String instead of HTML.
Instead of, use innerText or textContent:
doc.getElementById("datetime").innerText = dt.toLocaleTimeString();
doc.getElementById("datetime").textContent = dt.toLocaleTimeString();

Related

document.getElementById(...) is null in Chrome but working on older browsers like Old IE [duplicate]

This question already has answers here:
Why does jQuery or a DOM method such as getElementById not find the element?
(6 answers)
Closed 4 years ago.
I am getting an error as in the title when I open the console in Chrome and Firefox. However, everything is working fine on older browser like older IE versions. You can check this image.
I am attaching the script:
function MoveNext()
{
var qno = document.getElementById("txtQueNo").value;
var qcode = document.getElementById("txtQueCode").value;
var quetot = document.getElementById("quetot").value;
var que_avl = document.getElementById("que_avl").value;
var stdid = document.getElementById("txtStdID").value;
var oltid = document.getElementById("txtOLTID").value;
var ans = document.getElementById("txtAnswer").value;
var time = document.getElementById("disp").value;
I'm adding the full script for reference.
The issue is on the last line of the above code.
Thank you.
The only occurrence of "disp" in your php is as a name and not an ID (id="txt").
You can use document.getElementsByName("disp")[0].value instead. This will of course return an array of all elements with name="disp" but as you only have one in the php provided, this should be the correct assignment for the 0 based index.

JavaScript:: Is innerText safe to use? [duplicate]

This question already has answers here:
'innerText' works in IE, but not in Firefox
(15 answers)
Closed 9 years ago.
I've heard that using el.innerText||el.textContent can yield unreliable results, and that's why I've always insisted on using the following function in the past:
function getText(node) {
if (node.nodeType === 3) {
return node.data;
}
var txt = '';
if (node = node.firstChild) do {
txt += getText(node);
} while (node = node.nextSibling);
return txt;
}
This function goes through all nodes within an element and gathers the text of all text nodes, and text within descendants:
E.g.
<div id="x">foo <em>foo...</em> foo</div>
Result:
getText(document.getElementById('x')); // => "foo foo... foo"
I'm quite sure there are issues with using innerText and textContent, but I've not been able to find a definitive list anywhere and I am starting to wonder if it's just hearsay.
Can anyone offer any information about the possibly lacking reliability of textContent/innerText?
EDIT: Found this great answer by Kangax -- 'innerText' works in IE, but not in Firefox
It's all about endlines and whitespace - browsers are very inconsistent in this regard, especially so in Internet Explorer. Doing the traversal is a sure-fire way to get identical results in all browsers.

How to detect whether browser supports :invalid pseudoclass? [duplicate]

This question already has answers here:
Test if a browser supports a CSS selector
(5 answers)
Closed 8 years ago.
I tried to use Modernizr, but it seems not to support this feature detection.
I also read that it is difficult or even inmpossible to access pseudoclasses from javascript, because they are not part of DOM. So, after surfing the web I found no relevant information.
I need an easy solution without the need to download heavy libraries.
Can anybody help me with this?
Thanks
Trap an error from querySelector or matches, which parses the selector and throws an error if it is not valid:
function invalid_pseudoclass_support () {
var support = true;
try {
document.querySelector(':invalid');
} catch (e) {
support = false;
}
return support;
}

Javascript Arrays - Ignoring Extra Index Values [duplicate]

This question already has answers here:
What does the comma operator do in JavaScript?
(5 answers)
Closed 8 years ago.
Using Javascript in Firefox, Safari and Chrome (didn't try IE), the following strange behavior happens:
data = new Array(1,3,5,7,9);
data[1,7,3] = 88;
alert( data ); // displays: 1,3,5,88,9
So apparently the value at index [3] has been changed (other tests show that it actually has changed data[3]).
The second command does not generate an error. It does not even generate a warning in NetBeans, nor an error when displayed in a browser.
I explored this a bit further. It appears that :
data[1,7,null,NaN,4,3]
also gets interpreted as data[3] -
this also works with other values than 3.
The last value in the list is used and the rest are ignored.
Does this behavior have some sort of meaning or purpose, or is it just an unexpected fault in the parser?
I was unable to find any documentation or explanation of this behavior/syntax.
You're using the comma operator.
<expr1>, <expr2>, <expr3>, ...
is an expression that evaluates each expression from left to right, and returns the value of the last one. So 1,7,3 evaluates to 3. So
data[1,7,3] = 88;
is equivalent to:
data[3] = 88;

document.createElement throwing error in IE 8. This command is not Supported ERROR [duplicate]

This question already has answers here:
Closed 11 years ago.
Possible Duplicate:
Javascript doesn't work in IE8
I have the following code
var ind=1;
try
{
rdo = document.createElement('<input type="radio" name="radioOptions" />');
}
catch(err)
{
rdo = document.createElement('input');
}
rdo.setAttribute('type','radio');// error
rdo.setAttribute('name','radioOptions');
rdo.id = 'radioOption_'+ind;
rdo.value = ind;
After a thorough checkup this line is throwing error on IE 8
rdo.setAttribute('type','radio')
and a strange fact is that when it is on the local system its not doing that.
I am dynamically adding this radio input to the form. And the Doc type i have set to
<!doctype html>
Any Idea what should work for all Browsers including the ASS HOLE IE
You can not change the type of input elements in IE with setAttribute(). You could try with rdo.type = 'radio' (which should work) or (ugh) innerHTML.
Also, document.createElement() is used with the element's name, i.e. input. It is not like $() in jQuery or similar libraries.

Categories

Resources