Title: [106736] trunk/LayoutTests
- Revision
- 106736
- Author
- [email protected]
- Date
- 2012-02-04 02:09:16 -0800 (Sat, 04 Feb 2012)
Log Message
http/tests/security/xss-eval fails due to difference in JSC and V8 eval
https://bugs.webkit.org/show_bug.cgi?id=77806
Reviewed by Eric Seidel.
Both the JSC and V8 behaviors are reasonable in this case. This patch
modifies the test to show that either behavior isn't a security
vulnerability.
* http/tests/security/xss-eval.html:
* platform/chromium/http/tests/security/xss-eval-expected.txt:
* platform/chromium/test_expectations.txt:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (106735 => 106736)
--- trunk/LayoutTests/ChangeLog 2012-02-04 09:50:47 UTC (rev 106735)
+++ trunk/LayoutTests/ChangeLog 2012-02-04 10:09:16 UTC (rev 106736)
@@ -1,3 +1,18 @@
+2012-02-04 Adam Barth <[email protected]>
+
+ http/tests/security/xss-eval fails due to difference in JSC and V8 eval
+ https://bugs.webkit.org/show_bug.cgi?id=77806
+
+ Reviewed by Eric Seidel.
+
+ Both the JSC and V8 behaviors are reasonable in this case. This patch
+ modifies the test to show that either behavior isn't a security
+ vulnerability.
+
+ * http/tests/security/xss-eval.html:
+ * platform/chromium/http/tests/security/xss-eval-expected.txt:
+ * platform/chromium/test_expectations.txt:
+
2012-02-04 David Grogan <[email protected]>
IndexedDB: mark quota layout test WONTFIX
Modified: trunk/LayoutTests/http/tests/security/xss-eval.html (106735 => 106736)
--- trunk/LayoutTests/http/tests/security/xss-eval.html 2012-02-04 09:50:47 UTC (rev 106735)
+++ trunk/LayoutTests/http/tests/security/xss-eval.html 2012-02-04 10:09:16 UTC (rev 106736)
@@ -25,16 +25,27 @@
}
}
+document.testExpando = "It's me!";
+
addEventListener("message", function()
{
- shouldBe("eval.call(frames[0], 'document')", (function() { try { return eval.call(frames[0], 'document'); } catch(e) { return e.name; } })(), "EvalError");
+ (function() {
+ try {
+ var doc = eval.call(frames[0], 'document');
+ // V8 execute the eval our scope, which is safe.
+ shouldBe("documentFromEval", doc.testExpando, "It's me!")
+ } catch(e) {
+ // JSC throws an exception, which is also safe.
+ shouldBe("eval.call(frames[0], 'document')", e.name, "EvalError");
+ }
+ })();
shouldBe("childEval.call(frames[0], 'document')", (function() { try { return childEval.call(frames[0], 'document'); } catch(e) { return e.name; } })(), "EvalError");
shouldBe("childEvalCaller('document')", (function() { try { return childEvalCaller('document'); } catch(e) { return e.name; } })(), "TypeError");
-
+
shouldBe("childLocalEvalCaller('document')", (function() { try { return childLocalEvalCaller('document'); } catch(e) { return e.name; } })(), "EvalError");
-
+
if (window.layoutTestController)
layoutTestController.notifyDone();
}, false);
Modified: trunk/LayoutTests/platform/chromium/http/tests/security/xss-eval-expected.txt (106735 => 106736)
--- trunk/LayoutTests/platform/chromium/http/tests/security/xss-eval-expected.txt 2012-02-04 09:50:47 UTC (rev 106735)
+++ trunk/LayoutTests/platform/chromium/http/tests/security/xss-eval-expected.txt 2012-02-04 10:09:16 UTC (rev 106736)
@@ -4,7 +4,7 @@
If the test passes, you'll see a pass message below.
-PASS: eval.call(frames[0], 'document') should be EvalError and is.
+PASS: documentFromEval should be It's me! and is.
PASS: childEval.call(frames[0], 'document') should be EvalError and is.
PASS: childEvalCaller('document') should be TypeError and is.
PASS: childLocalEvalCaller('document') should be EvalError and is.
Modified: trunk/LayoutTests/platform/chromium/test_expectations.txt (106735 => 106736)
--- trunk/LayoutTests/platform/chromium/test_expectations.txt 2012-02-04 09:50:47 UTC (rev 106735)
+++ trunk/LayoutTests/platform/chromium/test_expectations.txt 2012-02-04 10:09:16 UTC (rev 106736)
@@ -796,7 +796,6 @@
BUGWK71451 LINUX : http/tests/security/contentSecurityPolicy/policy-does-not-affect-child.html = TEXT PASS
BUGWK71451 LINUX : http/tests/security/contentSecurityPolicy/object-src-none-allowed.html = TEXT PASS
BUGWK59552 SNOWLEOPARD DEBUG : http/tests/security/cross-frame-access-custom.html = PASS CRASH
-BUGRICOW : http/tests/security/xss-eval.html = TEXT
BUGWK72272 WIN : security/crypto-random-values-types.html = TEXT PASS
BUGCR24182 WIN RELEASE : http/tests/security/cross-origin-css.html = PASS TIMEOUT
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
