Firefox extension missing from addons.mozilla.org about github-hovercard HOT 9 OPEN

Hello,

Due to issues discovered during the review process, your add-on GitHub Hovercard has been disabled on addons.mozilla.org and no longer appears in the gallery. Users who have previously installed your add-on will be able to continue using it.

Please see the reviewer's comments below for more information.

---

Details:
This version didn't pass review because of the following problems:

1. This add-on is creating DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML, jQuery.html, or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Safely_inserting_external_content_into_a_page . Here are some examples that were discovered:

hovercard.js - line 2067

Please fix them and submit again.

from github-hovercard.

If you still remember what the problem was, can you please put it up as an issue so that someone can take it up?

From what you have described, I think I know what you are talking about. I might be able to help fix the issue if it is not too grave.

from github-hovercard.

Google sent me a taken down notification yesterday claiming that I didn’t respond to their “previous” violation notification email which I didn’t receive. I contacted Google after that but haven’t received any response yet.

from github-hovercard.

It has been taken it down by Mozilla and I was told they think there might be security vulnerabilities due to a core feature relies on directly outputting HTML from GitHub API (GitHub’s Markdown rendering API). Unfortunately I haven’t find time to deal with this yet.

from github-hovercard.

@Justineo Has it been removed from the Chrome Web Store for the same reason or have you taken it down? :o

from github-hovercard.

Update: The Chrome extension is back online. Reviewers for Firefox Add-on haven't replied my inquiry yet.

from github-hovercard.

Any updates regarding the firefox extension? I just got a new PC and realized I've been taking this extension for far too granted!

from github-hovercard.

Still not available in FF store

from github-hovercard.

Still unavailable from the addons site. Can it be installed manually?

from github-hovercard.