rest of patch for bug 317334 - hang when long wrappable string is passed to prompt() [e.g. as used in the exploit for IE's <body onload=window()> bug], r=mconnor

2006-07-29 12:47:26 +00:00 · 2006-07-29 12:47:26 +00:00 · 5411896814
--- a/toolkit/content/commonDialog.js
+++ b/toolkit/content/commonDialog.js
@ -124,16 +124,9 @@ function commonDialogOnLoad()
  }

  // display the main text
-  var messageText = gCommonDialogParam.GetString(0);
-  var messageParent = document.getElementById("info.box");
-  var messageParagraphs = messageText.split("\n");
-
-  for (var i = 0; i < messageParagraphs.length; i++) {
-    var descriptionNode = document.createElement("description");
-    var text = document.createTextNode(messageParagraphs[i]);
-    descriptionNode.appendChild(text);
-    messageParent.appendChild(descriptionNode);
-  }
+  var messageParent = document.getElementById("info.box").getElementsByTagName('description')[0];
+  // XXX the substr(0, 10000) part is a workaround for bug 317334
+  messageParent.textContent = gCommonDialogParam.GetString(0).substr(0, 10000);

  setElementText("info.header", gCommonDialogParam.GetString(3), true);

--- a/toolkit/content/commonDialog.xul
+++ b/toolkit/content/commonDialog.xul
@ -31,7 +31,7 @@
 #endif
      <!-- text -->
      <description id="info.header" class="header"/>
-      <vbox id="info.box">
+      <vbox id="info.box" style="white-space: -moz-pre-wrap;">
        <description/>
      </vbox>

--- a/toolkit/content/xul.css
+++ b/toolkit/content/xul.css
@ -1005,10 +1005,6 @@ dialogheader {
  -moz-binding: url("chrome://global/content/bindings/dialog.xml#dialogheader");
 }

-dialog .info-box {
-  white-space: -moz-pre-wrap;
-}
-
 /********* page ************/

 page {