Bug 432919 - "Help viewer content pane should not allow scripts, plugins, meta redirects, or subframes" [p=reed/dveditz r=Waldo (NPOTB)]

toolkit/components/help/content/help.js

@@ -137,6 +137,12 @@ function init() {
   helpGlossaryPanel = document.getElementById("help-glossary-panel");
   helpBrowser = document.getElementById("help-content");
 
+  // Turn off unnecessary features for security
+  helpBrowser.docShell.allowJavascript = false;
+  helpBrowser.docShell.allowPlugins = false;
+  helpBrowser.docShell.allowSubframes = false;
+  helpBrowser.docShell.allowMetaRedirects = false;
+
   strBundle = document.getElementById("bundle_help");
   emptySearchText = strBundle.getString("emptySearchText");