Add-ons/Reviewers/Guide/Reviewing: Difference between revisions

| style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | They may be used with hardcoded JS strings, but using closures is preferred. Only reject if it looks like remote code is being evaluated.

| style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Reject if it's clear from the sources that the code being injected is remote and unsanitized. The canned response points to the [https://developer.mozilla.org/en-US/Add-ons/Overlay_Extensions/XUL_School/DOM_Building_and_HTML_Insertion preferred documentation] about this topic. Assignments to <code>innerHTML</code> will result in the execution of any JavaScript code present in the injected string. Since this issue can often be confusing to developers, make sure to include a reference to a code file and line where this occurs.