Title: [132511] trunk
- Revision
- 132511
- Author
- [email protected]
- Date
- 2012-10-25 12:07:02 -0700 (Thu, 25 Oct 2012)
Log Message
XSSAuditor must replace form action with about:blank when reflected action detected.
https://bugs.webkit.org/show_bug.cgi?id=100280
Reviewed by Daniel Bates.
Source/WebCore:
Changes empty string form-action replacement to about:blank.
Existing form-action.html test modified to check this case.
* html/parser/XSSAuditor.cpp:
(WebCore::XSSAuditor::filterFormToken):
LayoutTests:
Update tests to log form action attribute.
* http/tests/security/xssAuditor/form-action-expected.txt:
* http/tests/security/xssAuditor/form-action.html:
* http/tests/security/xssAuditor/resources/echo-intertag.pl:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (132510 => 132511)
--- trunk/LayoutTests/ChangeLog 2012-10-25 19:05:19 UTC (rev 132510)
+++ trunk/LayoutTests/ChangeLog 2012-10-25 19:07:02 UTC (rev 132511)
@@ -1,3 +1,16 @@
+2012-10-25 Tom Sepez <[email protected]>
+
+ XSSAuditor must replace form action with about:blank when reflected action detected.
+ https://bugs.webkit.org/show_bug.cgi?id=100280
+
+ Reviewed by Daniel Bates.
+
+ Update tests to log form action attribute.
+
+ * http/tests/security/xssAuditor/form-action-expected.txt:
+ * http/tests/security/xssAuditor/form-action.html:
+ * http/tests/security/xssAuditor/resources/echo-intertag.pl:
+
2012-10-25 KwangYong Choi <[email protected]>
[EFL] Plugin test gardening
Modified: trunk/LayoutTests/http/tests/security/xssAuditor/form-action-expected.txt (132510 => 132511)
--- trunk/LayoutTests/http/tests/security/xssAuditor/form-action-expected.txt 2012-10-25 19:05:19 UTC (rev 132510)
+++ trunk/LayoutTests/http/tests/security/xssAuditor/form-action-expected.txt 2012-10-25 19:07:02 UTC (rev 132511)
@@ -1,3 +1,4 @@
CONSOLE MESSAGE: Refused to execute a _javascript_ script. Source code of script found within request.
+ALERT: Form action set to about:blank
Modified: trunk/LayoutTests/http/tests/security/xssAuditor/form-action.html (132510 => 132511)
--- trunk/LayoutTests/http/tests/security/xssAuditor/form-action.html 2012-10-25 19:05:19 UTC (rev 132510)
+++ trunk/LayoutTests/http/tests/security/xssAuditor/form-action.html 2012-10-25 19:07:02 UTC (rev 132511)
@@ -4,12 +4,13 @@
<script>
if (window.testRunner) {
testRunner.dumpAsText();
+ testRunner.waitUntilDone();
testRunner.setXSSAuditorEnabled(true);
}
</script>
</head>
<body>
-<iframe src=""
+<iframe src=""
</iframe>
</body>
</html>
Modified: trunk/LayoutTests/http/tests/security/xssAuditor/resources/echo-intertag.pl (132510 => 132511)
--- trunk/LayoutTests/http/tests/security/xssAuditor/resources/echo-intertag.pl 2012-10-25 19:05:19 UTC (rev 132510)
+++ trunk/LayoutTests/http/tests/security/xssAuditor/resources/echo-intertag.pl 2012-10-25 19:07:02 UTC (rev 132511)
@@ -38,6 +38,12 @@
if ($cgi->param('q2')) {
print $cgi->param('q2');
}
+if ($cgi->param('showAction')) {
+ print "<script>\n";
+ print "if (window.testRunner)\n";
+ print " alert('Form action set to ' + document.forms[0].action);\n";
+ print "</script>\n";
+}
if ($cgi->param('notifyDone')) {
print "<script>\n";
print "if (window.testRunner)\n";
Modified: trunk/Source/WebCore/ChangeLog (132510 => 132511)
--- trunk/Source/WebCore/ChangeLog 2012-10-25 19:05:19 UTC (rev 132510)
+++ trunk/Source/WebCore/ChangeLog 2012-10-25 19:07:02 UTC (rev 132511)
@@ -1,3 +1,16 @@
+2012-10-25 Tom Sepez <[email protected]>
+
+ XSSAuditor must replace form action with about:blank when reflected action detected.
+ https://bugs.webkit.org/show_bug.cgi?id=100280
+
+ Reviewed by Daniel Bates.
+
+ Changes empty string form-action replacement to about:blank.
+ Existing form-action.html test modified to check this case.
+
+ * html/parser/XSSAuditor.cpp:
+ (WebCore::XSSAuditor::filterFormToken):
+
2012-10-25 Kevin Ellis <[email protected]>
Touch adjustment snaps to wrong target at a plugin boundary.
Modified: trunk/Source/WebCore/html/parser/XSSAuditor.cpp (132510 => 132511)
--- trunk/Source/WebCore/html/parser/XSSAuditor.cpp 2012-10-25 19:05:19 UTC (rev 132510)
+++ trunk/Source/WebCore/html/parser/XSSAuditor.cpp 2012-10-25 19:07:02 UTC (rev 132511)
@@ -428,7 +428,7 @@
ASSERT(token.type() == HTMLTokenTypes::StartTag);
ASSERT(hasName(token, formTag));
- return eraseAttributeIfInjected(token, actionAttr);
+ return eraseAttributeIfInjected(token, actionAttr, blankURL().string());
}
bool XSSAuditor::eraseDangerousAttributesIfInjected(HTMLToken& token)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
