From 95b0f24a09f26451ea15b6297e3558f9025569b1 Mon Sep 17 00:00:00 2001
From: "sayrer%gmail.com"
 <sayrer%gmail.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sat, 12 Aug 2006 04:46:43 +0000
Subject: [PATCH] Bug 340554. Provide sanitizing fragment sinks for use with
 feeds. r=mrbkap. sr=jst

git-svn-id: svn://10.0.0.236/trunk@207207 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../components/feeds/src/FeedWriter.js        |  44 +--
 mozilla/content/base/public/nsContentCID.h    |   8 +
 mozilla/content/base/src/nsContentSink.h      | 161 ++++++++
 mozilla/content/base/src/nsContentUtils.cpp   |   5 +
 mozilla/content/base/src/nsGkAtomList.h       |   6 +
 .../src/nsHTMLFragmentContentSink.cpp         | 365 +++++++++++++++++-
 .../xml/document/src/nsXMLContentSink.h       |   2 +-
 .../document/src/nsXMLFragmentContentSink.cpp | 322 +++++++++++++++
 mozilla/layout/build/nsLayoutModule.cpp       |  12 +
 mozilla/layout/generic/nsHTMLParts.h          |   6 +
 .../public/nsIFragmentContentSink.h           |  11 +
 .../feeds/public/nsIFeedTextConstruct.idl     |   9 +-
 .../public/nsIScriptableUnescapeHTML.idl      |  14 +-
 .../components/feeds/src/FeedProcessor.js     |  21 +
 .../toolkit/components/feeds/src/Makefile.in  |   1 +
 .../feeds/src/nsScriptableUnescapeHTML.cpp    | 127 +++++-
 16 files changed, 1082 insertions(+), 32 deletions(-)

diff --git a/mozilla/browser/components/feeds/src/FeedWriter.js b/mozilla/browser/components/feeds/src/FeedWriter.js
index 50ed660262e..5959eb067ac 100755
--- a/mozilla/browser/components/feeds/src/FeedWriter.js
+++ b/mozilla/browser/components/feeds/src/FeedWriter.js
@@ -56,6 +56,7 @@ function LOG(str) {
     dump("*** Feeds: " + str + "\n");
 }
 
+const XML_NS = "http://www.w3.org/XML/1998/namespace"
 const HTML_NS = "http://www.w3.org/1999/xhtml";
 const TYPE_MAYBE_FEED = "application/vnd.mozilla.maybe.feed";
 const URI_BUNDLE = "chrome://browser/locale/feeds/subscribe.properties";
@@ -196,9 +197,6 @@ FeedWriter.prototype = {
    *          The container of entries in the feed
    */
   _writeFeedContent: function FW__writeFeedContent(container) {
-    // XXXben - do something with this. parameterize?
-    const MAX_CHARS = 600;
-    
     // Build the actual feed content
     var feedContent = this._document.getElementById("feedContent");
     var feed = container.QueryInterface(Ci.nsIFeed);
@@ -209,7 +207,7 @@ FeedWriter.prototype = {
       
       var entryContainer = this._document.createElementNS(HTML_NS, "div");
       entryContainer.className = "entry";
-      
+
       // If the entry has a title, make it a like
       if (entry.title) {
         var a = this._document.createElementNS(HTML_NS, "a");
@@ -224,31 +222,31 @@ FeedWriter.prototype = {
         entryContainer.appendChild(title);
       }
 
-      
-
       var body = this._document.createElementNS(HTML_NS, "p");
       var summary = entry.summary || entry.content;
-      if (summary) 
-        summary = summary.plainText();
-      if (summary && summary.length > MAX_CHARS)
-        summary = summary.substring(0, MAX_CHARS) + "...";
+      var docFragment = null;
+      if (summary) {
 
-      // XXXben - Change to use innerHTML
-      body.appendChild(this._document.createTextNode(summary));
-      body.className = "feedEntryContent";
+        if (summary.base)
+          body.setAttributeNS(XML_NS, "base", summary.base.spec);
+        else
+          LOG("no base?");
+        docFragment = summary.createDocumentFragment(body);
+        body.appendChild(docFragment);
+
+        // If the entry doesn't have a title, append a # permalink
+        // See http://scripting.com/rss.xml for an example
+        if (!entry.title && entry.link) {
+          var a = this._document.createElementNS(HTML_NS, "a");
+          a.appendChild(this._document.createTextNode("#"));
+          this._safeSetURIAttribute(a, "href", entry.link.spec);
+          body.appendChild(this._document.createTextNode(" "));
+          body.appendChild(a);
+        }
 
-      // If the entry doesn't have a title, append a # permalink
-      // See http://scripting.com/rss.xml for an example
-      if (!entry.title && entry.link) {
-        var a = this._document.createElementNS(HTML_NS, "a");
-        a.appendChild(this._document.createTextNode("#"));
-        this._safeSetURIAttribute(a, "href", entry.link.spec);
-        body.appendChild(this._document.createTextNode(" "));
-        body.appendChild(a);
       }
-
+      body.className = "feedEntryContent";
       entryContainer.appendChild(body);
-      
       feedContent.appendChild(entryContainer);
     }
   },
diff --git a/mozilla/content/base/public/nsContentCID.h b/mozilla/content/base/public/nsContentCID.h
index 12bc9e916a4..4e1729dc4a2 100644
--- a/mozilla/content/base/public/nsContentCID.h
+++ b/mozilla/content/base/public/nsContentCID.h
@@ -223,6 +223,10 @@
 #define NS_HTMLFRAGMENTSINK2_CID \
 { 0x13111d00, 0xce81, 0x11d6, { 0x80, 0x82, 0xec, 0xf3, 0x66, 0x5a, 0xf6, 0x7c } }
 
+// {A47E9526-6E48-4574-9D6C-3164E271F74E}
+#define NS_HTMLPARANOIDFRAGMENTSINK_CID \
+{ 0xa47e9526, 0x6e48, 0x4574, { 0x9d, 0x6c, 0x31, 0x64, 0xe2, 0x71, 0xf7, 0x4e } }
+
 // {4B664E54-72A2-4bbf-A5C2-66D4DC3066A0}
 #define NS_XMLFRAGMENTSINK_CID \
 { 0x4b664e54, 0x72a2, 0x4bbf, { 0xa5, 0xc2, 0x66, 0xd4, 0xdc, 0x30, 0x66, 0xa0 } }
@@ -231,6 +235,10 @@
 #define NS_XMLFRAGMENTSINK2_CID \
 { 0x4dc30689, 0x929d, 0x425e, { 0xa7, 0x9, 0x8, 0x2c, 0x62, 0x94, 0xe5, 0x42 } }
 
+// {2D78BBF0-E26C-482B-92B3-78A7B2AFC8F7}
+#define NS_XHTMLPARANOIDFRAGMENTSINK_CID  \
+{ 0x2d78bbf0, 0xe26c, 0x482b, { 0x92, 0xb3, 0x78, 0xa7, 0xb2, 0xaf, 0xc8, 0xf7} }
+
 // {3986B301-097C-11d3-BF87-00105A1B0627}
 #define NS_XULPOPUPLISTENER_CID \
 { 0x3986b301, 0x97c, 0x11d3, { 0xbf, 0x87, 0x0, 0x10, 0x5a, 0x1b, 0x6, 0x27 } }
diff --git a/mozilla/content/base/src/nsContentSink.h b/mozilla/content/base/src/nsContentSink.h
index 4252fee1b31..beb74adce15 100644
--- a/mozilla/content/base/src/nsContentSink.h
+++ b/mozilla/content/base/src/nsContentSink.h
@@ -52,6 +52,9 @@
 #include "nsCOMArray.h"
 #include "nsString.h"
 #include "nsAutoPtr.h"
+#include "nsHTMLAtoms.h"
+#include "nsTHashtable.h"
+#include "nsHashKeys.h"
 
 class nsIDocument;
 class nsIURI;
@@ -125,4 +128,162 @@ protected:
   PRBool mNeedToBlockParser;
 };
 
+// these two lists are used by the sanitizing fragment serializers
+static nsIAtom** const kDefaultAllowedTags [] = {
+  &nsHTMLAtoms::a,
+  &nsHTMLAtoms::abbr,
+  &nsHTMLAtoms::acronym,
+  &nsHTMLAtoms::address,
+  &nsHTMLAtoms::area,
+  &nsHTMLAtoms::b,
+  &nsHTMLAtoms::big,
+  &nsHTMLAtoms::blockquote,
+  &nsHTMLAtoms::br,
+  &nsHTMLAtoms::button,
+  &nsHTMLAtoms::caption,
+  &nsHTMLAtoms::center,
+  &nsHTMLAtoms::cite,
+  &nsHTMLAtoms::code,
+  &nsHTMLAtoms::col,
+  &nsHTMLAtoms::colgroup,
+  &nsHTMLAtoms::dd,
+  &nsHTMLAtoms::del,
+  &nsHTMLAtoms::dfn,
+  &nsHTMLAtoms::dir,
+  &nsHTMLAtoms::div,
+  &nsHTMLAtoms::dl,
+  &nsHTMLAtoms::dt,
+  &nsHTMLAtoms::em,
+  &nsHTMLAtoms::fieldset,
+  &nsHTMLAtoms::font,
+  &nsHTMLAtoms::form,
+  &nsHTMLAtoms::h1,
+  &nsHTMLAtoms::h2,
+  &nsHTMLAtoms::h3,
+  &nsHTMLAtoms::h4,
+  &nsHTMLAtoms::h5,
+  &nsHTMLAtoms::h6,
+  &nsHTMLAtoms::hr,
+  &nsHTMLAtoms::i,
+  &nsHTMLAtoms::img,
+  &nsHTMLAtoms::input,
+  &nsHTMLAtoms::ins,
+  &nsHTMLAtoms::kbd,
+  &nsHTMLAtoms::label,
+  &nsHTMLAtoms::legend,
+  &nsHTMLAtoms::li,
+  &nsHTMLAtoms::map,
+  &nsHTMLAtoms::menu,
+  &nsHTMLAtoms::ol,
+  &nsHTMLAtoms::optgroup,
+  &nsHTMLAtoms::option,
+  &nsHTMLAtoms::p,
+  &nsHTMLAtoms::pre,
+  &nsHTMLAtoms::q,
+  &nsHTMLAtoms::s,
+  &nsHTMLAtoms::samp,
+  &nsHTMLAtoms::select,
+  &nsHTMLAtoms::small,
+  &nsHTMLAtoms::span,
+  &nsHTMLAtoms::strike,
+  &nsHTMLAtoms::strong,
+  &nsHTMLAtoms::sub,
+  &nsHTMLAtoms::sup,
+  &nsHTMLAtoms::table,
+  &nsHTMLAtoms::tbody,
+  &nsHTMLAtoms::td,
+  &nsHTMLAtoms::textarea,
+  &nsHTMLAtoms::tfoot,
+  &nsHTMLAtoms::th,
+  &nsHTMLAtoms::thead,
+  &nsHTMLAtoms::tr,
+  &nsHTMLAtoms::tt,
+  &nsHTMLAtoms::u,
+  &nsHTMLAtoms::ul
+};
+
+static nsIAtom** const kDefaultAllowedAttributes [] = {
+  &nsHTMLAtoms::accept,
+  &nsHTMLAtoms::acceptcharset,
+  &nsHTMLAtoms::accesskey,
+  &nsHTMLAtoms::action,
+  &nsHTMLAtoms::align,
+  &nsHTMLAtoms::alt,
+  &nsHTMLAtoms::axis,
+  &nsHTMLAtoms::border,
+  &nsHTMLAtoms::cellpadding,
+  &nsHTMLAtoms::cellspacing,
+  &nsHTMLAtoms::_char,
+  &nsHTMLAtoms::charoff,
+  &nsHTMLAtoms::charset,
+  &nsHTMLAtoms::checked,
+  &nsHTMLAtoms::cite,
+  &nsHTMLAtoms::_class,
+  &nsHTMLAtoms::clear,
+  &nsHTMLAtoms::cols,
+  &nsHTMLAtoms::colspan,
+  &nsHTMLAtoms::color,
+  &nsHTMLAtoms::compact,
+  &nsHTMLAtoms::coords,
+  &nsHTMLAtoms::datetime,
+  &nsHTMLAtoms::dir,
+  &nsHTMLAtoms::disabled,
+  &nsHTMLAtoms::enctype,
+  &nsHTMLAtoms::_for,
+  &nsHTMLAtoms::frame,
+  &nsHTMLAtoms::headers,
+  &nsHTMLAtoms::height,
+  &nsHTMLAtoms::href,
+  &nsHTMLAtoms::hreflang,
+  &nsHTMLAtoms::hspace,
+  &nsHTMLAtoms::id,
+  &nsHTMLAtoms::ismap,
+  &nsHTMLAtoms::label,
+  &nsHTMLAtoms::lang,
+  &nsHTMLAtoms::longdesc,
+  &nsHTMLAtoms::maxlength,
+  &nsHTMLAtoms::media,
+  &nsHTMLAtoms::method,
+  &nsHTMLAtoms::multiple,
+  &nsHTMLAtoms::name,
+  &nsHTMLAtoms::nohref,
+  &nsHTMLAtoms::noshade,
+  &nsHTMLAtoms::nowrap,
+  &nsHTMLAtoms::prompt,
+  &nsHTMLAtoms::readonly,
+  &nsHTMLAtoms::rel,
+  &nsHTMLAtoms::rev,
+  &nsHTMLAtoms::rows,
+  &nsHTMLAtoms::rowspan,
+  &nsHTMLAtoms::rules,
+  &nsHTMLAtoms::scope,
+  &nsHTMLAtoms::selected,
+  &nsHTMLAtoms::shape,
+  &nsHTMLAtoms::size,
+  &nsHTMLAtoms::span,
+  &nsHTMLAtoms::src,
+  &nsHTMLAtoms::start,
+  &nsHTMLAtoms::summary,
+  &nsHTMLAtoms::tabindex,
+  &nsHTMLAtoms::target,
+  &nsHTMLAtoms::title,
+  &nsHTMLAtoms::type,
+  &nsHTMLAtoms::usemap,
+  &nsHTMLAtoms::valign,
+  &nsHTMLAtoms::value,
+  &nsHTMLAtoms::vspace,
+  &nsHTMLAtoms::width
+};
+
+// URIs action, href, src, longdesc, usemap, cite
+static
+PRBool IsAttrURI(nsIAtom *aName)
+{
+  return (aName == nsHTMLAtoms::action ||
+          aName == nsHTMLAtoms::href ||
+          aName == nsHTMLAtoms::src ||
+          aName == nsHTMLAtoms::longdesc ||
+          aName == nsHTMLAtoms::usemap ||
+          aName == nsHTMLAtoms::cite);
+}
 #endif // _nsContentSink_h_
diff --git a/mozilla/content/base/src/nsContentUtils.cpp b/mozilla/content/base/src/nsContentUtils.cpp
index 6d1a5e6ef42..e909eff6549 100644
--- a/mozilla/content/base/src/nsContentUtils.cpp
+++ b/mozilla/content/base/src/nsContentUtils.cpp
@@ -135,6 +135,8 @@ static NS_DEFINE_CID(kXTFServiceCID, NS_XTFSERVICE_CID);
 #include "nsIEventListenerManager.h"
 #include "nsAttrName.h"
 #include "nsIDOMUserDataHandler.h"
+#include "nsIFragmentContentSink.h"
+
 #ifdef IBMBIDI
 #include "nsIBidiKeyboard.h"
 #endif
@@ -601,6 +603,9 @@ nsContentUtils::Shutdown()
 {
   sInitialized = PR_FALSE;
 
+  NS_HTMLParanoidFragmentSinkShutdown();
+  NS_XHTMLParanoidFragmentSinkShutdown();
+
   NS_IF_RELEASE(sContentPolicyService);
   sTriedToGetContentPolicy = PR_FALSE;
   PRInt32 i;
diff --git a/mozilla/content/base/src/nsGkAtomList.h b/mozilla/content/base/src/nsGkAtomList.h
index 368c2480dd6..cd0dcca4457 100755
--- a/mozilla/content/base/src/nsGkAtomList.h
+++ b/mozilla/content/base/src/nsGkAtomList.h
@@ -76,9 +76,11 @@ GK_ATOM(acceltext, "acceltext")
 GK_ATOM(accept, "accept")
 GK_ATOM(acceptcharset, "accept-charset")
 GK_ATOM(accesskey, "accesskey")
+GK_ATOM(acronym, "acronym")
 GK_ATOM(action, "action")
 GK_ATOM(active, "active")
 GK_ATOM(actuate, "actuate")
+GK_ATOM(address, "address")
 GK_ATOM(after, "after")
 GK_ATOM(after_end, "after_end")
 GK_ATOM(after_start, "after_start")
@@ -404,6 +406,7 @@ GK_ATOM(iscontainer, "iscontainer")
 GK_ATOM(isempty, "isempty")
 GK_ATOM(isindex, "isindex")
 GK_ATOM(ismap, "ismap")
+GK_ATOM(kbd, "kbd")
 GK_ATOM(key, "key")
 GK_ATOM(keycode, "keycode")
 GK_ATOM(keydown, "keydown")
@@ -676,6 +679,7 @@ GK_ATOM(rtl, "rtl")
 GK_ATOM(rule, "rule")
 GK_ATOM(rules, "rules")
 GK_ATOM(s, "s")
+GK_ATOM(samp, "samp")
 GK_ATOM(scheme, "scheme")
 GK_ATOM(scope, "scope")
 GK_ATOM(screen, "screen")
@@ -751,7 +755,9 @@ GK_ATOM(substate, "substate")
 GK_ATOM(substring, "substring")
 GK_ATOM(substringAfter, "substring-after")
 GK_ATOM(substringBefore, "substring-before")
+GK_ATOM(sub, "sub")
 GK_ATOM(sum, "sum")
+GK_ATOM(sup, "sup")
 GK_ATOM(summary, "summary")
 GK_ATOM(systemProperty, "system-property")
 GK_ATOM(tab, "tab")
diff --git a/mozilla/content/html/document/src/nsHTMLFragmentContentSink.cpp b/mozilla/content/html/document/src/nsHTMLFragmentContentSink.cpp
index 22d2b9621db..c660cfe0a4d 100644
--- a/mozilla/content/html/document/src/nsHTMLFragmentContentSink.cpp
+++ b/mozilla/content/html/document/src/nsHTMLFragmentContentSink.cpp
@@ -21,6 +21,7 @@
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Robert Sayre <sayrer@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -61,6 +62,8 @@
 #include "nsContentCreatorFunctions.h"
 #include "nsNetUtil.h"
 #include "nsIScriptSecurityManager.h"
+#include "nsContentSink.h"
+#include "nsTHashtable.h"
 
 //
 // XXX THIS IS TEMPORARY CODE
@@ -120,8 +123,8 @@ public:
   PRInt32 PushContent(nsIContent *aContent);
   nsIContent* PopContent();
 
-  nsresult AddAttributes(const nsIParserNode& aNode,
-                         nsIContent* aContent);
+  virtual nsresult AddAttributes(const nsIParserNode& aNode,
+                                 nsIContent* aContent);
 
   nsresult AddText(const nsAString& aString);
   nsresult AddTextToContent(nsIContent* aContent, const nsAString& aText);
@@ -821,3 +824,361 @@ nsHTMLFragmentContentSink::AddAttributes(const nsIParserNode& aNode,
 
   return NS_OK;
 }
+
+// nsHTMLParanoidFragmentSink
+
+// Find the whitelist of allowed elements and attributes in
+// nsContentSink.h We share it with nsHTMLParanoidFragmentSink
+
+class nsHTMLParanoidFragmentSink : public nsHTMLFragmentContentSink
+{
+public:
+  nsHTMLParanoidFragmentSink();
+
+  static nsresult Init();
+  static void Cleanup();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+
+  NS_IMETHOD OpenContainer(const nsIParserNode& aNode);
+  NS_IMETHOD CloseContainer(const nsHTMLTag aTag);
+  NS_IMETHOD AddLeaf(const nsIParserNode& aNode);
+  NS_IMETHOD AddComment(const nsIParserNode& aNode);
+  NS_IMETHOD AddProcessingInstruction(const nsIParserNode& aNode);
+
+  nsresult AddAttributes(const nsIParserNode& aNode,
+                         nsIContent* aContent);
+protected:
+  nsresult NameFromType(const nsHTMLTag aTag,
+                        nsIAtom **aResult);
+
+  nsresult NameFromNode(const nsIParserNode& aNode,
+                        nsIAtom **aResult);
+  
+  PRBool mSkip; // used when we descend into <style> or <script>
+
+  // Use nsTHashTable as a hash set for our whitelists
+  static nsTHashtable<nsISupportsHashKey>* sAllowedTags;
+  static nsTHashtable<nsISupportsHashKey>* sAllowedAttributes;
+};
+
+nsTHashtable<nsISupportsHashKey>* nsHTMLParanoidFragmentSink::sAllowedTags;
+nsTHashtable<nsISupportsHashKey>* nsHTMLParanoidFragmentSink::sAllowedAttributes;
+
+nsHTMLParanoidFragmentSink::nsHTMLParanoidFragmentSink():
+  nsHTMLFragmentContentSink(PR_FALSE), mSkip(PR_FALSE)
+{
+}
+
+nsresult
+nsHTMLParanoidFragmentSink::Init()
+{
+  nsresult rv = NS_ERROR_FAILURE;
+  
+  if (sAllowedTags) {
+    return NS_OK;
+  }
+
+  PRUint32 size = NS_ARRAY_LENGTH(kDefaultAllowedTags);
+  sAllowedTags = new nsTHashtable<nsISupportsHashKey>();
+  if (sAllowedTags) {
+    rv = sAllowedTags->Init(size);
+    for (PRUint32 i = 0; i < size && NS_SUCCEEDED(rv); i++) {
+      if (!sAllowedTags->PutEntry(*kDefaultAllowedTags[i])) {
+        rv = NS_ERROR_OUT_OF_MEMORY;
+      }
+    }
+  }
+
+  size = NS_ARRAY_LENGTH(kDefaultAllowedAttributes);
+  sAllowedAttributes = new nsTHashtable<nsISupportsHashKey>();
+  if (sAllowedAttributes && NS_SUCCEEDED(rv)) {
+    rv = sAllowedAttributes->Init(size);
+    for (PRUint32 i = 0; i < size && NS_SUCCEEDED(rv); i++) {
+      if (!sAllowedAttributes->PutEntry(*kDefaultAllowedAttributes[i])) {
+        rv = NS_ERROR_OUT_OF_MEMORY;
+      }
+    }
+  }
+
+  if (NS_FAILED(rv)) {
+    NS_WARNING("Failed to populate whitelist hash sets");
+    Cleanup();
+    return rv; 
+  }
+
+  return rv;
+}
+
+void
+nsHTMLParanoidFragmentSink::Cleanup()
+{
+  if (sAllowedTags) {
+    delete sAllowedTags;
+    sAllowedTags = nsnull;
+  }
+  
+  if (sAllowedAttributes) {
+    delete sAllowedAttributes;
+    sAllowedAttributes = nsnull;
+  }
+}
+
+nsresult
+NS_NewHTMLParanoidFragmentSink(nsIFragmentContentSink** aResult)
+{
+  nsHTMLParanoidFragmentSink* it = new nsHTMLParanoidFragmentSink();
+  if (!it) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  nsresult rv = nsHTMLParanoidFragmentSink::Init();
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ADDREF(*aResult = it);
+  
+  return NS_OK;
+}
+
+void
+NS_HTMLParanoidFragmentSinkShutdown()
+{
+  nsHTMLParanoidFragmentSink::Cleanup();
+}
+
+NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLParanoidFragmentSink,
+                             nsHTMLFragmentContentSink)
+
+nsresult
+nsHTMLParanoidFragmentSink::NameFromType(const nsHTMLTag aTag,
+                                         nsIAtom **aResult)
+{
+  nsIParserService* parserService = nsContentUtils::GetParserService();
+  if (!parserService) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  NS_IF_ADDREF(*aResult = parserService->HTMLIdToAtomTag(aTag));
+  
+  return NS_OK;
+}
+
+nsresult
+nsHTMLParanoidFragmentSink::NameFromNode(const nsIParserNode& aNode,
+                                         nsIAtom **aResult)
+{
+  nsresult rv;
+  eHTMLTags type = (eHTMLTags)aNode.GetNodeType();
+  
+  *aResult = nsnull;
+  if (type == eHTMLTag_userdefined) {
+    nsCOMPtr<nsINodeInfo> nodeInfo;
+    rv =
+      mNodeInfoManager->GetNodeInfo(aNode.GetText(), nsnull,
+                                    kNameSpaceID_None,
+                                    getter_AddRefs(nodeInfo));
+    NS_ENSURE_SUCCESS(rv, rv);
+    NS_IF_ADDREF(*aResult = nodeInfo->NameAtom());
+  } else {
+    rv = NameFromType(type, aResult);
+  }
+  return rv;
+}
+
+// nsHTMLFragmentContentSink
+
+nsresult
+nsHTMLParanoidFragmentSink::AddAttributes(const nsIParserNode& aNode,
+                                          nsIContent* aContent)
+{
+  PRInt32 ac = aNode.GetAttributeCount();
+
+  if (ac == 0) {
+    return NS_OK;
+  }
+
+  nsCAutoString k;
+  nsHTMLTag nodeType = nsHTMLTag(aNode.GetNodeType());
+
+  nsresult rv;
+  // use this to check for safe URIs in the few attributes that allow them
+  nsIScriptSecurityManager* secMan = nsContentUtils::GetSecurityManager();
+  nsCOMPtr<nsIURI> baseURI;
+
+  for (PRInt32 i = ac - 1; i >= 0; i--) {
+    rv = NS_OK;
+    const nsAString& key = aNode.GetKeyAt(i);
+    CopyUTF16toUTF8(key, k);
+    ToLowerCase(k);
+
+    nsCOMPtr<nsIAtom> keyAtom = do_GetAtom(k);
+
+    // not an allowed attribute
+    if (!sAllowedAttributes || !sAllowedAttributes->GetEntry(keyAtom)) {
+      continue;
+    }
+
+    // Get value and remove mandatory quotes
+    static const char* kWhitespace = "\n\r\t\b";
+    const nsAString& v =
+      nsContentUtils::TrimCharsInSet(kWhitespace, aNode.GetValueAt(i));
+
+    // check the attributes we allow that contain URIs
+    if (IsAttrURI(keyAtom)) {
+      if (!baseURI) {
+        baseURI = aContent->GetBaseURI();
+      }
+      nsCOMPtr<nsIURI> attrURI;
+      rv = NS_NewURI(getter_AddRefs(attrURI), v, nsnull, baseURI);
+      if (NS_SUCCEEDED(rv)) {
+        rv = secMan->CheckLoadURIWithPrincipal(mTargetDocument->NodePrincipal(),
+                                               attrURI,
+                                               nsIScriptSecurityManager::DISALLOW_SCRIPT_OR_DATA);
+      }
+    }
+    
+    // skip to the next attribute if we encountered issues with the
+    // current value
+    if (NS_FAILED(rv)) {
+      continue;
+    }
+
+    if (nodeType == eHTMLTag_a && keyAtom == nsHTMLAtoms::name) {
+      NS_ConvertUTF16toUTF8 cname(v);
+      NS_ConvertUTF8toUTF16 uv(nsUnescape(cname.BeginWriting()));
+      // Add attribute to content
+      aContent->SetAttr(kNameSpaceID_None, keyAtom, uv, PR_FALSE);
+    } else {
+      // Add attribute to content
+      aContent->SetAttr(kNameSpaceID_None, keyAtom, v, PR_FALSE);
+    }
+
+    if (nodeType == eHTMLTag_a || 
+        nodeType == eHTMLTag_form ||
+        nodeType == eHTMLTag_img ||
+        nodeType == eHTMLTag_map ||
+        nodeType == eHTMLTag_q ||
+        nodeType == eHTMLTag_blockquote ||
+        nodeType == eHTMLTag_input) {
+      AddBaseTagInfo(aContent);
+    }
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsHTMLParanoidFragmentSink::OpenContainer(const nsIParserNode& aNode)
+{
+  nsresult rv = NS_OK;
+  
+  // bail if it's a script or style, or we're already inside one of those
+  eHTMLTags type = (eHTMLTags)aNode.GetNodeType();
+  if (type == eHTMLTag_script || type == eHTMLTag_style) {
+    mSkip = PR_TRUE;
+    return rv;
+  }
+
+  nsCOMPtr<nsIAtom> name;
+  rv = NameFromNode(aNode, getter_AddRefs(name));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // not on whitelist
+  if (!sAllowedTags || !sAllowedTags->GetEntry(name)) {
+    return NS_OK;
+  }
+
+  return nsHTMLFragmentContentSink::OpenContainer(aNode);
+}
+
+NS_IMETHODIMP
+nsHTMLParanoidFragmentSink::CloseContainer(const nsHTMLTag aTag)
+{
+  nsresult rv = NS_OK;
+
+  if (mSkip) {
+    mSkip = PR_FALSE;
+    return rv;
+  }
+
+  nsCOMPtr<nsIAtom> name;
+  rv = NameFromType(aTag, getter_AddRefs(name));
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  // not on whitelist
+  if (!sAllowedTags || !sAllowedTags->GetEntry(name)) {
+    return NS_OK;
+  }
+
+  return nsHTMLFragmentContentSink::CloseContainer(aTag);
+}
+
+NS_IMETHODIMP
+nsHTMLParanoidFragmentSink::AddLeaf(const nsIParserNode& aNode)
+{
+  NS_ENSURE_TRUE(mNodeInfoManager, NS_ERROR_NOT_INITIALIZED);
+  
+  nsresult rv = NS_OK;
+
+#ifndef MOZILLA_1_8_BRANCH
+  if (mSkip) {
+    return rv;
+  }
+#endif
+  
+  if (aNode.GetTokenType() == eToken_start) {
+    nsCOMPtr<nsIAtom> name;
+    rv = NameFromNode(aNode, getter_AddRefs(name));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+#ifdef MOZILLA_1_8_BRANCH
+    // we have to do this on the branch for some late 90s reason
+    if (name == nsHTMLAtoms::script || name == nsHTMLAtoms::style) {
+      nsCOMPtr<nsIDTD> dtd;
+      mParser->GetDTD(getter_AddRefs(dtd));
+      NS_ENSURE_TRUE(dtd, NS_ERROR_FAILURE);
+
+      nsAutoString skippedContent;
+      PRInt32 lineNo = 0;                
+      dtd->CollectSkippedContent(nodeType, skippedContent, lineNo);
+    }
+#endif
+
+    // We will process base tags, but we won't include them
+    // in the output
+    if (name == nsHTMLAtoms::base) {
+      nsCOMPtr<nsIContent> content;
+      nsCOMPtr<nsINodeInfo> nodeInfo;
+      nsIParserService* parserService = nsContentUtils::GetParserService();
+      if (!parserService)
+        return NS_ERROR_OUT_OF_MEMORY;
+      rv = mNodeInfoManager->GetNodeInfo(name, nsnull,
+                                         kNameSpaceID_None,
+                                         getter_AddRefs(nodeInfo));
+      NS_ENSURE_SUCCESS(rv, rv);
+      NS_NewHTMLElement(getter_AddRefs(content), nodeInfo);
+      NS_ENSURE_SUCCESS(rv, rv);
+      AddAttributes(aNode, content);
+      ProcessBaseTag(content);
+      return NS_OK;
+    }
+
+    if (!sAllowedTags || !sAllowedTags->GetEntry(name)) {
+      return NS_OK;
+    }
+  }
+
+  return nsHTMLFragmentContentSink::AddLeaf(aNode);
+}
+
+NS_IMETHODIMP
+nsHTMLParanoidFragmentSink::AddComment(const nsIParserNode& aNode)
+{
+  // no comments
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsHTMLParanoidFragmentSink::AddProcessingInstruction(const nsIParserNode& aNode)
+{
+  // no PIs
+  return NS_OK;
+}
diff --git a/mozilla/content/xml/document/src/nsXMLContentSink.h b/mozilla/content/xml/document/src/nsXMLContentSink.h
index 5398d796b0d..f97b6d4f0b0 100644
--- a/mozilla/content/xml/document/src/nsXMLContentSink.h
+++ b/mozilla/content/xml/document/src/nsXMLContentSink.h
@@ -99,7 +99,7 @@ public:
 protected:
   void StartLayout();
 
-  nsresult AddAttributes(const PRUnichar** aNode, nsIContent* aContent);
+  virtual nsresult AddAttributes(const PRUnichar** aNode, nsIContent* aContent);
   nsresult AddText(const PRUnichar* aString, PRInt32 aLength);
   nsresult ProcessEndSCRIPTTag(nsIContent* aContent, nsIContent* aParent);
 
diff --git a/mozilla/content/xml/document/src/nsXMLFragmentContentSink.cpp b/mozilla/content/xml/document/src/nsXMLFragmentContentSink.cpp
index a3d1c6ce551..9e79ac16b4a 100644
--- a/mozilla/content/xml/document/src/nsXMLFragmentContentSink.cpp
+++ b/mozilla/content/xml/document/src/nsXMLFragmentContentSink.cpp
@@ -21,6 +21,7 @@
  *
  * Contributor(s):
  *   Blake Kaplan <mrbkap@gmail.com>
+ *   Robert Sayre <sayrer@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -52,6 +53,12 @@
 #include "nsDOMError.h"
 #include "nsIConsoleService.h"
 #include "nsServiceManagerUtils.h"
+#include "nsContentUtils.h"
+#include "nsIScriptSecurityManager.h"
+#include "nsNetUtil.h"
+#include "nsTHashtable.h"
+#include "nsHashKeys.h"
+#include "nsTArray.h"
 
 class nsXMLFragmentContentSink : public nsXMLContentSink,
                                  public nsIFragmentContentSink
@@ -270,6 +277,7 @@ nsXMLFragmentContentSink::HandleDoctypeDecl(const nsAString & aSubset,
                                             nsISupports* aCatalogData)
 {
   NS_NOTREACHED("fragments shouldn't have doctype declarations");
+
   return NS_OK;
 }
 
@@ -437,3 +445,317 @@ nsXMLFragmentContentSink::IgnoreFirstContainer()
   return NS_ERROR_FAILURE;
 }
 
+
+// nsXHTMLParanoidFragmentSink
+
+// Find the whitelist of allowed elements and attributes in
+// nsContentSink.h We share it with nsHTMLParanoidFragmentSink
+
+class nsXHTMLParanoidFragmentSink : public nsXMLFragmentContentSink
+{
+public:
+  nsXHTMLParanoidFragmentSink();
+
+  static nsresult Init();
+  static void Cleanup();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+  
+  // nsXMLContentSink
+  nsresult AddAttributes(const PRUnichar** aNode, nsIContent* aContent);
+
+  // nsIExpatSink
+  NS_IMETHOD HandleStartElement(const PRUnichar *aName,
+                                const PRUnichar **aAtts,
+                                PRUint32 aAttsCount, PRInt32 aIndex,
+                                PRUint32 aLineNumber);
+    
+  NS_IMETHOD HandleEndElement(const PRUnichar *aName);
+
+  NS_IMETHOD HandleComment(const PRUnichar *aName);
+
+  NS_IMETHOD HandleProcessingInstruction(const PRUnichar *aTarget, 
+                                         const PRUnichar *aData);
+
+  NS_IMETHOD HandleCDataSection(const PRUnichar *aData, 
+                                PRUint32 aLength);
+
+  NS_IMETHOD HandleCharacterData(const PRUnichar *aData,
+                                 PRUint32 aLength);
+protected:
+  PRUint32 mSkipLevel; // used when we descend into <style> or <script>
+  // Use nsTHashTable as a hash set for our whitelists
+  static nsTHashtable<nsISupportsHashKey>* sAllowedTags;
+  static nsTHashtable<nsISupportsHashKey>* sAllowedAttributes;
+};
+
+nsTHashtable<nsISupportsHashKey>* nsXHTMLParanoidFragmentSink::sAllowedTags;
+nsTHashtable<nsISupportsHashKey>* nsXHTMLParanoidFragmentSink::sAllowedAttributes;
+
+nsXHTMLParanoidFragmentSink::nsXHTMLParanoidFragmentSink():
+  nsXMLFragmentContentSink(PR_FALSE), mSkipLevel(0)
+{
+}
+
+nsresult
+nsXHTMLParanoidFragmentSink::Init()
+{
+  nsresult rv = NS_ERROR_FAILURE;
+  
+  if (sAllowedTags) {
+    return NS_OK;
+  }
+
+  PRUint32 size = NS_ARRAY_LENGTH(kDefaultAllowedTags);
+  sAllowedTags = new nsTHashtable<nsISupportsHashKey>();
+  if (sAllowedTags) {
+    rv = sAllowedTags->Init(size);
+    for (PRUint32 i = 0; i < size && NS_SUCCEEDED(rv); i++) {
+      if (!sAllowedTags->PutEntry(*kDefaultAllowedTags[i])) {
+        rv = NS_ERROR_OUT_OF_MEMORY;
+      }
+    }
+  }
+
+  size = NS_ARRAY_LENGTH(kDefaultAllowedAttributes);
+  sAllowedAttributes = new nsTHashtable<nsISupportsHashKey>();
+  if (sAllowedAttributes && NS_SUCCEEDED(rv)) {
+    rv = sAllowedAttributes->Init(size);
+    for (PRUint32 i = 0; i < size && NS_SUCCEEDED(rv); i++) {
+      if (!sAllowedAttributes->PutEntry(*kDefaultAllowedAttributes[i])) {
+        rv = NS_ERROR_OUT_OF_MEMORY;
+      }
+    }
+  }
+
+  if (NS_FAILED(rv)) {
+    NS_WARNING("Failed to populate whitelist hash sets");
+    Cleanup();
+  }
+
+  return rv;
+}
+
+void
+nsXHTMLParanoidFragmentSink::Cleanup()
+{
+  if (sAllowedTags) {
+    delete sAllowedTags;
+    sAllowedTags = nsnull;
+  }
+  
+  if (sAllowedAttributes) {
+    delete sAllowedAttributes;
+    sAllowedAttributes = nsnull;
+  }
+}
+
+nsresult
+NS_NewXHTMLParanoidFragmentSink(nsIFragmentContentSink** aResult)
+{
+  nsXHTMLParanoidFragmentSink* it = new nsXHTMLParanoidFragmentSink();
+  if (!it) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  nsresult rv = nsXHTMLParanoidFragmentSink::Init();
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ADDREF(*aResult = it);
+  
+  return NS_OK;
+}
+
+void
+NS_XHTMLParanoidFragmentSinkShutdown()
+{
+  nsXHTMLParanoidFragmentSink::Cleanup();
+}
+
+NS_IMPL_ISUPPORTS_INHERITED0(nsXHTMLParanoidFragmentSink,
+                             nsXMLFragmentContentSink)
+
+nsresult
+nsXHTMLParanoidFragmentSink::AddAttributes(const PRUnichar** aAtts,
+                                           nsIContent* aContent)
+{
+  nsresult rv;
+
+  // use this to check for safe URIs in the few attributes that allow them
+  nsIScriptSecurityManager* secMan = nsContentUtils::GetSecurityManager();
+  nsCOMPtr<nsIURI> baseURI;
+  PRUint32 flags = nsIScriptSecurityManager::DISALLOW_SCRIPT_OR_DATA;
+
+  // scrub URI attributes that point at dangerous content
+  // We have to do this here, because this is where we have a base URI,
+  // but we can't do all the scrubbing here, because other parts of the
+  // code get the attributes before this method is called.
+  nsTArray<const PRUnichar *> allowedAttrs;
+  PRInt32 nameSpaceID;
+  nsCOMPtr<nsIAtom> prefix, localName;
+  nsCOMPtr<nsINodeInfo> nodeInfo;
+  while (*aAtts) {
+    nsContentUtils::SplitExpatName(aAtts[0], getter_AddRefs(prefix),
+                                   getter_AddRefs(localName), &nameSpaceID);
+    rv = mNodeInfoManager->GetNodeInfo(localName, prefix, nameSpaceID,
+                                       getter_AddRefs(nodeInfo));
+    NS_ENSURE_SUCCESS(rv, rv);
+    // check the attributes we allow that contain URIs
+    if (IsAttrURI(nodeInfo->NameAtom())) {
+      if (!aAtts[1])
+        rv = NS_ERROR_FAILURE;
+      if (!baseURI)
+        baseURI = aContent->GetBaseURI();
+      nsCOMPtr<nsIURI> attrURI;
+      rv = NS_NewURI(getter_AddRefs(attrURI), nsDependentString(aAtts[1]),
+                     nsnull, baseURI);
+      if (NS_SUCCEEDED(rv)) {
+        rv = secMan->CheckLoadURIWithPrincipal(mTargetDocument->NodePrincipal(),
+                                               attrURI, flags);
+      }
+    }
+
+    if (NS_SUCCEEDED(rv)) {
+      allowedAttrs.AppendElement(aAtts[0]);
+      allowedAttrs.AppendElement(aAtts[1]);
+    }
+
+    aAtts += 2;
+  }
+  allowedAttrs.AppendElement((const PRUnichar*) nsnull);
+
+  return nsXMLFragmentContentSink::AddAttributes(allowedAttrs.Elements(),
+                                                 aContent);
+}
+
+NS_IMETHODIMP
+nsXHTMLParanoidFragmentSink::HandleStartElement(const PRUnichar *aName,
+                                                const PRUnichar **aAtts,
+                                                PRUint32 aAttsCount,
+                                                PRInt32 aIndex,
+                                                PRUint32 aLineNumber)
+{
+  nsresult rv;
+  PRInt32 nameSpaceID;
+  nsCOMPtr<nsIAtom> prefix, localName;
+  nsContentUtils::SplitExpatName(aName, getter_AddRefs(prefix),
+                                 getter_AddRefs(localName), &nameSpaceID);
+  
+  // If the element is not in the XHTML namespace, bounce it
+  if (nameSpaceID != kNameSpaceID_XHTML)
+    return NS_OK;
+  
+  nsCOMPtr<nsINodeInfo> nodeInfo;
+  rv = mNodeInfoManager->GetNodeInfo(localName, prefix, nameSpaceID,
+                                     getter_AddRefs(nodeInfo));
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  // bounce it if it's not on the whitelist or we're inside
+  // <script> or <style>
+  nsCOMPtr<nsIAtom> name = nodeInfo->NameAtom();
+  if (mSkipLevel != 0 ||
+      name == nsHTMLAtoms::script ||
+      name == nsHTMLAtoms::style) {
+    ++mSkipLevel; // track this so we don't spew script text
+    return NS_OK;
+  }  
+  
+  if (!sAllowedTags || !sAllowedTags->GetEntry(name))
+    return NS_OK;
+  
+  // It's an allowed element, so let's scrub the attributes
+  nsTArray<const PRUnichar *> allowedAttrs;
+  for (PRUint32 i = 0; i < aAttsCount; i += 2) {
+    nsContentUtils::SplitExpatName(aAtts[i], getter_AddRefs(prefix),
+                                   getter_AddRefs(localName), &nameSpaceID);
+    rv = mNodeInfoManager->GetNodeInfo(localName, prefix, nameSpaceID,
+                                       getter_AddRefs(nodeInfo));
+    NS_ENSURE_SUCCESS(rv, rv);
+    
+    name = nodeInfo->NameAtom();
+    // Add if it's xmlns, xml:, or on the HTML whitelist
+    if (nameSpaceID == kNameSpaceID_XMLNS ||
+        nameSpaceID == kNameSpaceID_XML ||
+        sAllowedAttributes && sAllowedAttributes->GetEntry(name)) {
+      allowedAttrs.AppendElement(aAtts[i]);
+      allowedAttrs.AppendElement(aAtts[i + 1]);
+    }
+  }
+  allowedAttrs.AppendElement((const PRUnichar*) nsnull);
+  return
+    nsXMLFragmentContentSink::HandleStartElement(aName,
+                                                 allowedAttrs.Elements(),
+                                                 allowedAttrs.Length() - 1,
+                                                 aIndex,
+                                                 aLineNumber);
+}
+
+NS_IMETHODIMP 
+nsXHTMLParanoidFragmentSink::HandleEndElement(const PRUnichar *aName)
+{
+  nsresult rv;
+  PRInt32 nameSpaceID;
+  nsCOMPtr<nsIAtom> prefix, localName;
+  nsContentUtils::SplitExpatName(aName, getter_AddRefs(prefix),
+                                 getter_AddRefs(localName), &nameSpaceID);
+  
+  // If the element is not in the XHTML namespace, bounce it
+  if (nameSpaceID != kNameSpaceID_XHTML) {
+    return NS_OK;
+  }
+  
+  nsCOMPtr<nsINodeInfo> nodeInfo;
+  rv = mNodeInfoManager->GetNodeInfo(localName, prefix, nameSpaceID,
+                                     getter_AddRefs(nodeInfo));
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  nsCOMPtr<nsIAtom> name = nodeInfo->NameAtom();
+  if (mSkipLevel != 0) {
+    --mSkipLevel;
+    return NS_OK;
+  }
+
+  if (!sAllowedTags || !sAllowedTags->GetEntry(name)) {
+    return NS_OK;
+  }
+
+  return nsXMLFragmentContentSink::HandleEndElement(aName);
+}
+
+NS_IMETHODIMP
+nsXHTMLParanoidFragmentSink::
+HandleProcessingInstruction(const PRUnichar *aTarget, 
+                            const PRUnichar *aData)
+{
+  // We don't do PIs
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsXHTMLParanoidFragmentSink::HandleComment(const PRUnichar *aName)
+{
+  // We don't do comments
+  return NS_OK;
+}
+
+// We pass all character data through, unless we're inside <script>
+NS_IMETHODIMP 
+nsXHTMLParanoidFragmentSink::HandleCDataSection(const PRUnichar *aData, 
+                                                PRUint32 aLength)
+{
+  if (mSkipLevel != 0) {
+    return NS_OK;
+  }
+
+  return nsXMLFragmentContentSink::HandleCDataSection(aData, aLength);
+}
+
+NS_IMETHODIMP 
+nsXHTMLParanoidFragmentSink::HandleCharacterData(const PRUnichar *aData, 
+                                                 PRUint32 aLength)
+{
+  if (mSkipLevel != 0) {
+    return NS_OK;
+  }
+
+  return nsXMLFragmentContentSink::HandleCharacterData(aData, aLength);
+}
diff --git a/mozilla/layout/build/nsLayoutModule.cpp b/mozilla/layout/build/nsLayoutModule.cpp
index 007a6dea000..aab58d9bf17 100644
--- a/mozilla/layout/build/nsLayoutModule.cpp
+++ b/mozilla/layout/build/nsLayoutModule.cpp
@@ -437,8 +437,10 @@ MAKE_CTOR(CreateHTMLContentSerializer,    nsIContentSerializer,        NS_NewHTM
 MAKE_CTOR(CreatePlainTextSerializer,      nsIContentSerializer,        NS_NewPlainTextSerializer)
 MAKE_CTOR(CreateHTMLFragmentSink,         nsIFragmentContentSink,      NS_NewHTMLFragmentContentSink)
 MAKE_CTOR(CreateHTMLFragmentSink2,        nsIFragmentContentSink,      NS_NewHTMLFragmentContentSink2)
+MAKE_CTOR(CreateHTMLParanoidFragmentSink, nsIFragmentContentSink,      NS_NewHTMLParanoidFragmentSink)
 MAKE_CTOR(CreateXMLFragmentSink,          nsIFragmentContentSink,      NS_NewXMLFragmentContentSink)
 MAKE_CTOR(CreateXMLFragmentSink2,         nsIFragmentContentSink,      NS_NewXMLFragmentContentSink2)
+MAKE_CTOR(CreateXHTMLParanoidFragmentSink,nsIFragmentContentSink,      NS_NewXHTMLParanoidFragmentSink)
 MAKE_CTOR(CreateSanitizingHTMLSerializer, nsIContentSerializer,        NS_NewSanitizingHTMLSerializer)
 MAKE_CTOR(CreateXBLService,               nsIXBLService,               NS_NewXBLService)
 MAKE_CTOR(CreateContentPolicy,            nsIContentPolicy,            NS_NewContentPolicy)
@@ -1075,6 +1077,11 @@ static const nsModuleComponentInfo gComponents[] = {
     NS_HTMLFRAGMENTSINK2_CONTRACTID,
     CreateHTMLFragmentSink2 },
 
+  { "html paranoid fragment sink",
+    NS_HTMLPARANOIDFRAGMENTSINK_CID,
+    NS_HTMLPARANOIDFRAGMENTSINK_CONTRACTID,
+    CreateHTMLParanoidFragmentSink },
+
   { "HTML sanitizing content serializer",
     MOZ_SANITIZINGHTMLSERIALIZER_CID,
     MOZ_SANITIZINGHTMLSERIALIZER_CONTRACTID,
@@ -1090,6 +1097,11 @@ static const nsModuleComponentInfo gComponents[] = {
     NS_XMLFRAGMENTSINK2_CONTRACTID,
     CreateXMLFragmentSink2 },
 
+  { "xhtml paranoid fragment sink",
+    NS_XHTMLPARANOIDFRAGMENTSINK_CID,
+    NS_XHTMLPARANOIDFRAGMENTSINK_CONTRACTID,
+    CreateXHTMLParanoidFragmentSink },
+
   { "XBL Service",
     NS_XBLSERVICE_CID,
     "@mozilla.org/xbl;1",
diff --git a/mozilla/layout/generic/nsHTMLParts.h b/mozilla/layout/generic/nsHTMLParts.h
index f1feeda5306..5a030cb60e4 100644
--- a/mozilla/layout/generic/nsHTMLParts.h
+++ b/mozilla/layout/generic/nsHTMLParts.h
@@ -259,4 +259,10 @@ NS_NewHTMLFragmentContentSink(nsIFragmentContentSink** aInstancePtrResult);
 nsresult
 NS_NewHTMLFragmentContentSink2(nsIFragmentContentSink** aInstancePtrResult);
 
+// This strips all but a whitelist of elements and attributes defined
+// in nsContentSink.h
+nsresult
+NS_NewHTMLParanoidFragmentSink(nsIFragmentContentSink** aInstancePtrResult);
+void
+NS_HTMLParanoidFragmentSinkShutdown();
 #endif /* nsHTMLParts_h___ */
diff --git a/mozilla/parser/htmlparser/public/nsIFragmentContentSink.h b/mozilla/parser/htmlparser/public/nsIFragmentContentSink.h
index 847f99ecfaf..17d723fa1c7 100644
--- a/mozilla/parser/htmlparser/public/nsIFragmentContentSink.h
+++ b/mozilla/parser/htmlparser/public/nsIFragmentContentSink.h
@@ -106,9 +106,14 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIFragmentContentSink,
 
 #define NS_HTMLFRAGMENTSINK_CONTRACTID "@mozilla.org/layout/htmlfragmentsink;1"
 #define NS_HTMLFRAGMENTSINK2_CONTRACTID "@mozilla.org/layout/htmlfragmentsink;2"
+#define NS_HTMLPARANOIDFRAGMENTSINK_CONTRACTID \
+"@mozilla.org/htmlparanoidfragmentsink;1"
 
 #define NS_XMLFRAGMENTSINK_CONTRACTID "@mozilla.org/layout/xmlfragmentsink;1"
 #define NS_XMLFRAGMENTSINK2_CONTRACTID "@mozilla.org/layout/xmlfragmentsink;2"
+#define NS_XHTMLPARANOIDFRAGMENTSINK_CONTRACTID \
+"@mozilla.org/xhtmlparanoidfragmentsink;1"
+
 
 // the HTML versions are in nsHTMLParts.h
 nsresult
@@ -116,4 +121,10 @@ NS_NewXMLFragmentContentSink(nsIFragmentContentSink** aInstancePtrResult);
 nsresult
 NS_NewXMLFragmentContentSink2(nsIFragmentContentSink** aInstancePtrResult);
 
+// This strips all but a whitelist of elements and attributes defined
+// in nsContentSink.h
+nsresult
+NS_NewXHTMLParanoidFragmentSink(nsIFragmentContentSink** aInstancePtrResult);
+void
+NS_XHTMLParanoidFragmentSinkShutdown();
 #endif
diff --git a/mozilla/toolkit/components/feeds/public/nsIFeedTextConstruct.idl b/mozilla/toolkit/components/feeds/public/nsIFeedTextConstruct.idl
index 5838a7ac691..aa883df768e 100644
--- a/mozilla/toolkit/components/feeds/public/nsIFeedTextConstruct.idl
+++ b/mozilla/toolkit/components/feeds/public/nsIFeedTextConstruct.idl
@@ -37,13 +37,15 @@
 #include "nsISupports.idl"
 
 interface nsIURI;
+interface nsIDOMElement;
+interface nsIDOMDocumentFragment;
 
 /**
 * nsIFeedTextConstructs represent feed text fields that can contain
 * one of text, HTML, or XHTML. Some extension elements also have "type"
 * parameters, and this interface could be used there as well.
 */ 
-[scriptable, uuid(97dd2bd5-d04d-4be9-aeef-22c4f0102a44)]
+[scriptable, uuid(fc97a2a9-d649-4494-931e-db81a156c873)]
 interface nsIFeedTextConstruct : nsISupports 
 {
   /**
@@ -77,5 +79,10 @@ interface nsIFeedTextConstruct : nsISupports
    * this function returns the value of the text attribute unchanged.
    */
   AString plainText();
+
+  /**
+   * Return an nsIDocumentFragment containing the text and markup.
+   */
+  nsIDOMDocumentFragment createDocumentFragment(in nsIDOMElement element);
 };
  
diff --git a/mozilla/toolkit/components/feeds/public/nsIScriptableUnescapeHTML.idl b/mozilla/toolkit/components/feeds/public/nsIScriptableUnescapeHTML.idl
index f1206f5f666..9e68ac36b13 100644
--- a/mozilla/toolkit/components/feeds/public/nsIScriptableUnescapeHTML.idl
+++ b/mozilla/toolkit/components/feeds/public/nsIScriptableUnescapeHTML.idl
@@ -36,10 +36,14 @@
 
 #include "nsISupports.idl"
 
+interface nsIDOMElement;
+interface nsIDOMDocumentFragment;
+interface nsIURI;
+
 /**
  * A utility class that unescapes HTML strings.
  */
-[scriptable, uuid(0ff58de6-2460-4095-9ff9-9756efedc756)]
+[scriptable, uuid(3ab244a9-f09d-44da-9e3f-ee4d67367f2d)]
 interface nsIScriptableUnescapeHTML : nsISupports 
 {
   /** 
@@ -48,4 +52,12 @@ interface nsIScriptableUnescapeHTML : nsISupports
    * @param src The HTML string to escape.
    */ 
   AString unescape(in AString src);
+        
+  /**
+   * Appends the text to the element.
+   */
+  nsIDOMDocumentFragment parseFragment(in AString fragment,
+                                       in PRBool isXML,
+                                       in nsIURI baseURI,
+                                       in nsIDOMElement element);
 };
diff --git a/mozilla/toolkit/components/feeds/src/FeedProcessor.js b/mozilla/toolkit/components/feeds/src/FeedProcessor.js
index 530584c142f..41b20b4f0d5 100644
--- a/mozilla/toolkit/components/feeds/src/FeedProcessor.js
+++ b/mozilla/toolkit/components/feeds/src/FeedProcessor.js
@@ -478,6 +478,25 @@ TextConstruct.prototype = {
     }
     return this.text;
   },
+
+  createDocumentFragment: function TC_createDocumentFragment(element) {
+    if (this.type == "text") {
+      var doc = element.ownerDocument;
+      var docFragment = doc.createDocumentFragment();
+      var node = doc.createTextNode(this.text);
+      docFragment.appendChild(node);
+      return docFragment;
+    }
+    var isXML;
+    if (this.type == "xhtml")
+      isXML = true
+    else if (this.type == "html")
+      isXML = false;
+    else
+      return null;
+
+    return gUnescapeHTML.parseFragment(this.text, isXML, this.base, element);
+  },
  
   QueryInterface: function(iid) {
     if (iid.equals(Ci.nsIFeedTextConstruct) ||
@@ -1407,6 +1426,7 @@ FeedProcessor.prototype = {
       }
 
       newProp.type = type;
+      newProp.base = this._xmlBaseStack[this._xmlBaseStack.length - 1];
       container.setPropertyAsInterface(propName, newProp);
     }
     else {
@@ -1435,6 +1455,7 @@ FeedProcessor.prototype = {
                    createInstance(Ci.nsIFeedTextConstruct);
     newProp.text = chars;
     newProp.type = "xhtml";
+    newProp.base = this._xmlBaseStack[this._xmlBaseStack.length - 1];
     container.setPropertyAsInterface(this._prefixForNS(uri) + localName,
                                      newProp);
     
diff --git a/mozilla/toolkit/components/feeds/src/Makefile.in b/mozilla/toolkit/components/feeds/src/Makefile.in
index 683f1004643..978b5976645 100644
--- a/mozilla/toolkit/components/feeds/src/Makefile.in
+++ b/mozilla/toolkit/components/feeds/src/Makefile.in
@@ -52,6 +52,7 @@ REQUIRES	= \
 		xpcom \
 		necko \
 		string \
+		widget \
 		js \
 		dom \
 		htmlparser \
diff --git a/mozilla/toolkit/components/feeds/src/nsScriptableUnescapeHTML.cpp b/mozilla/toolkit/components/feeds/src/nsScriptableUnescapeHTML.cpp
index 7a8a5c5debc..556529060c1 100644
--- a/mozilla/toolkit/components/feeds/src/nsScriptableUnescapeHTML.cpp
+++ b/mozilla/toolkit/components/feeds/src/nsScriptableUnescapeHTML.cpp
@@ -42,6 +42,7 @@
 #include "nsXPCOM.h"
 #include "nsISupportsPrimitives.h"
 #include "nsXPIDLString.h"
+#include "nsIScriptLoader.h"
 
 #include "nsIParser.h"
 #include "nsIDTD.h"
@@ -52,10 +53,24 @@
 #include "nsIContentSink.h"
 #include "nsIHTMLToTextSink.h"
 #include "nsIDocumentEncoder.h"
-
+#include "nsIDOMDocumentFragment.h"
+#include "nsIFragmentContentSink.h"
+#include "nsIDOMDocument.h"
+#include "nsIDOMNodeList.h"
+#include "nsIDOMNode.h"
+#include "nsIDOMElement.h"
+#include "nsIDocument.h"
+#include "nsIContent.h"
+#include "nsAttrName.h"
+#include "nsHTMLParts.h"
+#include "nsContentCID.h"
 #include "nsIScriptableUnescapeHTML.h"
 #include "nsScriptableUnescapeHTML.h"
 
+#define XHTML_DIV_TAG "div xmlns=\"http://www.w3.org/1999/xhtml\""
+#define HTML_BODY_TAG "BODY"
+#define HTML_BASE_TAG "BASE"
+
 NS_IMPL_ISUPPORTS1(nsScriptableUnescapeHTML, nsIScriptableUnescapeHTML)
 
 static NS_DEFINE_CID(kCParserCID, NS_PARSER_CID);
@@ -72,8 +87,7 @@ nsScriptableUnescapeHTML::Unescape(const nsAString & aFromStr,
   aToStr.SetLength(0);
   nsresult rv;
   nsCOMPtr<nsIParser> parser = do_CreateInstance(kCParserCID, &rv);
-  if ( !parser )
-    return rv;
+  if (NS_FAILED(rv)) return rv;
 
   // convert it!
   nsCOMPtr<nsIContentSink> sink;
@@ -95,5 +109,110 @@ nsScriptableUnescapeHTML::Unescape(const nsAString & aFromStr,
   return NS_OK;
 }
 
+// The feed version of nsContentUtils::CreateContextualFragment It
+// creates a fragment, but doesn't go to all the effort to preserve
+// context like innerHTML does, because feed DOMs shouldn't have that.
+NS_IMETHODIMP
+nsScriptableUnescapeHTML::ParseFragment(const nsAString &aFragment,
+                                        PRBool aIsXML,
+                                        nsIURI* aBaseURI,
+                                        nsIDOMElement* aContextElement,
+                                        nsIDOMDocumentFragment** aReturn)
+{
+  NS_ENSURE_ARG(aContextElement);
+  *aReturn = nsnull;
 
-     
+  nsresult rv;
+  nsCOMPtr<nsIParser> parser = do_CreateInstance(kCParserCID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIDocument> document;
+  nsCOMPtr<nsIDOMDocument> domDocument;
+  nsCOMPtr<nsIDOMNode> contextNode;
+  contextNode = do_QueryInterface(aContextElement);
+  contextNode->GetOwnerDocument(getter_AddRefs(domDocument));
+  document = do_QueryInterface(domDocument);
+  NS_ENSURE_TRUE(document, NS_ERROR_NOT_AVAILABLE);
+  
+  // stop scripts
+  nsCOMPtr<nsIScriptLoader> loader;
+  PRBool scripts_enabled = PR_FALSE;
+  if (document) {
+    loader = document->GetScriptLoader();
+    if (loader) {
+      loader->GetEnabled(&scripts_enabled);
+    }
+  }
+  if (scripts_enabled) {
+    loader->SetEnabled(PR_FALSE);
+  }
+
+  // Wrap things in a div or body for parsing, but it won't show up in
+  // the fragment.
+  nsVoidArray tagStack;
+  nsCAutoString base, spec;
+  if (aIsXML) {
+    // XHTML
+    if (aBaseURI) {
+      base.Append(NS_LITERAL_CSTRING(XHTML_DIV_TAG));
+      base.Append(NS_LITERAL_CSTRING(" xml:base=\""));
+      aBaseURI->GetSpec(spec);
+      base = base + spec;
+      base.Append(NS_LITERAL_CSTRING("\""));
+      tagStack.AppendElement(ToNewUnicode(base));
+    }  else {
+      tagStack.AppendElement(ToNewUnicode(NS_LITERAL_CSTRING(XHTML_DIV_TAG)));
+    }
+  } else {
+    // HTML
+    tagStack.AppendElement(ToNewUnicode(NS_LITERAL_CSTRING(HTML_BODY_TAG)));
+    if (aBaseURI) {
+      base.Append(NS_LITERAL_CSTRING((HTML_BASE_TAG)));
+      base.Append(NS_LITERAL_CSTRING(" href=\""));
+      aBaseURI->GetSpec(spec);
+      base = base + spec;
+      base.Append(NS_LITERAL_CSTRING("\""));
+      tagStack.AppendElement(ToNewUnicode(base));
+    }
+  }
+
+  if (NS_SUCCEEDED(rv)) {
+    nsCAutoString contentType;
+    nsDTDMode mode;
+    nsCOMPtr<nsIFragmentContentSink> sink;
+    if (aIsXML) {
+      mode = eDTDMode_full_standards;
+      contentType = NS_LITERAL_CSTRING("application/xhtml+xml");
+      sink = do_CreateInstance(NS_XHTMLPARANOIDFRAGMENTSINK_CONTRACTID);
+    } else {
+      mode = eDTDMode_fragment;
+      contentType = NS_LITERAL_CSTRING("text/html");
+      sink = do_CreateInstance(NS_HTMLPARANOIDFRAGMENTSINK_CONTRACTID);
+    }
+    if (sink) {
+      sink->SetTargetDocument(document);
+      nsCOMPtr<nsIContentSink> contentsink(do_QueryInterface(sink));
+      parser->SetContentSink(contentsink);
+      rv = parser->ParseFragment(aFragment, nsnull, tagStack,
+                                 aIsXML, contentType, mode);
+      if (NS_SUCCEEDED(rv))
+        rv = sink->GetFragment(aReturn);
+
+    } else {
+      rv = NS_ERROR_FAILURE;
+    }
+  }
+
+  // from nsContentUtils XXX Ick! Delete strings we allocated above.
+  PRInt32 count = tagStack.Count();
+  for (PRInt32 i = 0; i < count; i++) {
+    PRUnichar* str = (PRUnichar*)tagStack.ElementAt(i);
+    if (str)
+      nsCRT::free(str);
+  }
+
+  if (scripts_enabled)
+      loader->SetEnabled(PR_TRUE);
+  
+  return rv;
+}