# How can I sanitize remote script in content script?

**URL:** <https://discourse.mozilla.org/t/how-can-i-sanitize-remote-script-in-content-script/16483>\
**Category:** addons.mozilla.org\
**Created:** [June 19, 2017, 5:42am UTC](https://discourse.mozilla.org/t/how-can-i-sanitize-remote-script-in-content-script/16483 "2017-06-19T05:42:00Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![getliner](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/getliner/32/30902_2.png) [@getliner](https://discourse.mozilla.org/u/getliner)\
**Post date:** [June 19, 2017, 5:42am UTC](https://discourse.mozilla.org/t/how-can-i-sanitize-remote-script-in-content-script/16483/1 "2017-06-19T05:42:00Z")

</div>

Hi.

I submitted my extension, but it was rejected because of potentially unsanitized data in content script.

My code is like as followings,

```
var actualCode +=
	'var colors = ' + colors + '; var linerItems = ' + items + '; ' +
	'var isPageSaved = ' + isPageSaved + '; ' +
	'proc.changeColor();’;
     var json = ['html:script', {}, actualCode];	
     var node = Util.jsonToDOM(json, document, {});

(document.head||document.documentElement).appendChild(node);
node.parentNode.removeChild(node);

```

(jsonToDom is in [https://developer.mozilla.org/en-US/Add-ons/Overlay\_Extensions/XUL\_School/DOM\_Building\_and\_HTML\_Insertion](https://developer.mozilla.org/en-US/Add-ons/Overlay_Extensions/XUL_School/DOM_Building_and_HTML_Insertion))

How can I sanitize that code?

Thanks.

---

<div class="post-metadata">

**Author:** ![getliner](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/getliner/32/30902_2.png) [@getliner](https://discourse.mozilla.org/u/getliner)\
**Post date:** [June 19, 2017, 8:35am UTC](https://discourse.mozilla.org/t/how-can-i-sanitize-remote-script-in-content-script/16483/2 "2017-06-19T08:35:01Z")

</div>

I searched and founded sanitize.js.

```
var actualCode +=
    'var colors = ' + colors + '; var linerItems = ' + items + '; ' +
    'var isPageSaved = ' + isPageSaved + '; ' +
  	    'proc.changeColor();’;
var json = ['html:script', {}, actualCode];
var node = Util.jsonToDOM(json, document, {});
var s = new Sanitize();
s.clean_node(node);
(document.head||document.documentElement).appendChild(node);
node.parentNode.removeChild(node);

```

So using Sanitize(), my code is sanitized?

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [June 20, 2017, 4:13am UTC](https://discourse.mozilla.org/t/how-can-i-sanitize-remote-script-in-content-script/16483/3 "2017-06-20T04:13:12Z")

</div>

> [@getliner](#):
>
> So using Sanitize(), my code is sanitized?

No … 😉

Inserting remote SCRIPT is not allowed and there is no way to sanitize a **Remote Script**

Inserting remote DOM may be allowed but that has many complications. You can use DOMPurify to sanitize the remote content but that does not guarantee that it will pass.

If you need remote data (not a whole bunch of DOM) then it would make it easier and the can be sanitized based on how you insert it.

Inserting un-sanitized remote content is a security problem. For example, JavaScript can be passed as href/src/on\*\* etc.  
Addon should ensure such strings are not-executable (and not javascript:somefunction).  
In case of href/src, a simple startsWith(‘http’) would be sufficient for this purpose.

---

<div class="post-metadata">

**Author:** ![getliner](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/getliner/32/30902_2.png) [@getliner](https://discourse.mozilla.org/u/getliner)\
**Post date:** [June 20, 2017, 4:18am UTC](https://discourse.mozilla.org/t/how-can-i-sanitize-remote-script-in-content-script/16483/4 "2017-06-20T04:18:13Z")

</div>

Thanks for replying.

I have one question.  
The SCRIPT are in extension not from server, then why you are saying remote SCRIPT?

Also my extension is injecting some scripts including lib, they are in extension not from server. Then is this also remote SCRIPT?

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [June 20, 2017, 4:35am UTC](https://discourse.mozilla.org/t/how-can-i-sanitize-remote-script-in-content-script/16483/5 "2017-06-20T04:35:53Z")

</div>

> [@getliner](#):
>
> The SCRIPT are in extension not from server, then why you are saying remote SCRIPT?

I said that because your topic title says: **How can I sanitize remote script in content script?**

---

<div class="post-metadata">

**Author:** ![getliner](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/getliner/32/30902_2.png) [@getliner](https://discourse.mozilla.org/u/getliner)\
**Post date:** [June 20, 2017, 4:39am UTC](https://discourse.mozilla.org/t/how-can-i-sanitize-remote-script-in-content-script/16483/6 "2017-06-20T04:39:00Z")

</div>

Ok.

Then injecting scripts in extenions is fine?

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [June 20, 2017, 4:57am UTC](https://discourse.mozilla.org/t/how-can-i-sanitize-remote-script-in-content-script/16483/7 "2017-06-20T04:57:47Z")

</div>

> [@getliner](#):
>
> Then injecting scripts in extenions is fine?

Injecting scripts that are inside the addon is allowed but that depends on the content of the script.

A JQuery JS inside the addon is allowed. A Google Analytics JS inside the addon is not allowed.

It all depends on the content of the script.  
For example, some script have remote script injection in them and they will be rejected.