1 files changed, 13 insertions, 5 deletions
diff --git a/data/extensions/https-everywhere-eff@eff.org/chrome/content/code/ApplicableList.js b/data/extensions/https-everywhere-eff@eff.org/chrome/content/code/ApplicableList.js
index 55179ff..1c5263a 100644
--- a/data/extensions/https-everywhere-eff@eff.org/chrome/content/code/ApplicableList.js
+++ b/data/extensions/https-everywhere-eff@eff.org/chrome/content/code/ApplicableList.js
@@ -73,9 +73,11 @@ ApplicableList.prototype = {
   populate_list: function() {
     // The base URI of the dom tends to be loaded from some /other/
     // ApplicableList, so pretend we're loading it from here.
-    HTTPSEverywhere.instance.https_rules.rewrittenURI(this, this.uri, function() {
-      // do nothing
-    });
+    var uri = this.uri;
+    if (!(uri.schemeIs("http") || uri.schemeIs("https"))) {
+      return true;
+    }
+    HTTPSEverywhere.instance.https_rules.rewrittenURI(this, uri);
     this.log(DBUG, "populating using alist #" + this.serial);
   },
 
@@ -215,9 +217,15 @@ ApplicableList.prototype = {
   },
 
   add_command: function(rule) {
+      // basic validation for data to be added to xul
+      var ruleId = String(rule.id);
+      if (!ruleId.match(/^[a-zA-Z_0-9]+$/)) {
+        return;
+      }
+
       var command = this.document.getElementById("https-everywhere-menuitem-rule-toggle-template").cloneNode();
-      command.setAttribute('id', JSON.stringify(rule.id)+'-command');
-      command.setAttribute('data-id', JSON.stringify(rule.id));
+      command.setAttribute('id', ruleId+'-command');
+      command.setAttribute('data-id', ruleId);
       command.setAttribute('label', rule.name);
       this.commandset.appendChild(command);
   },