title: Better Way to Sanitize HTML for Insertion
body: <p>In a recent review by the AMO editors, my Thunderbird addon's version was rejected because it "creates HTML from strings containing unsanitized data" - which "is a major security risk".</p>
  
  <p>I think I understand why.  Now, my problem is about how to solve that issue.</p>
  
  <p><a href="https://stackoverflow.com/questions/12757649/how-to-use-nsiparserutils-inside-firefox-addon-sdk-1-10-main-js">This thread</a> gave me some clues, but it's not quite what I need.</p>
  
  <p>My addon needs to paste the contents of the clipboard as a hyperlink, by using the clipboard contents as the link text, and inserting html around it like this: `" + clipboardtext + "".</p>
  
  <p>Now, if I am inserting the clipboard contents as HTML, I need to "sanitize" it first. Here is what I came up with.  Now, I haven't written in the regex part yet, because I don't think this is the best way to do this, although I think it will work:</p>
  
  <pre><code>function makeSafeHTML(whathtml){
      var parser = Cc["@mozilla.org/parserutils;1"].getService(Ci.nsIParserUtils);
      var sanitizedHTML = parser.sanitize(whathtml, 01);
  
      //now remove the extratags added by the sanitization method, perhaps via regex
      //"&lt;html&gt;&lt;head&gt;&lt;/head&gt;&lt;body&gt;"
      //"&lt;/body&gt;&lt;/html&gt;"
  
      return sanitizedHTML;
  }
  </code></pre>
  
  <p>My intent is to do this with the resulting "sanitized" string - this will paste the string as the <code>href</code> value of a hyperlink:</p>
  
  <pre><code>var html_editor = editor.QueryInterface(Components.interfaces.nsIHTMLEditor);
  html_editor.insertHTML("&lt;a href='"+whathref+"'&gt;"+whattext+"&lt;/a&gt;");
  </code></pre>
  
  <p>So I am looking for a better way to get sanitized HTML into a simple string variable.  Would any of you do it this way?</p>