Title: [144667] trunk
- Revision
- 144667
- Author
- [email protected]
- Date
- 2013-03-04 13:44:07 -0800 (Mon, 04 Mar 2013)
Log Message
XSSAuditor bypass with --> comment syntax.
https://bugs.webkit.org/show_bug.cgi?id=111349
Reviewed by Adam Barth.
Source/WebCore:
Test: http/tests/security/xssAuditor/open-iframe-src-03.html
* html/parser/XSSAuditor.cpp:
(WebCore::isTerminatingCharacter):
Adds ">" to the list of terminating characters, so that comments of
the form --> end the snippet we seek to match.
LayoutTests:
* http/tests/security/xssAuditor/open-iframe-src-03-expected.txt: Added.
* http/tests/security/xssAuditor/open-iframe-src-03.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (144666 => 144667)
--- trunk/LayoutTests/ChangeLog 2013-03-04 21:42:03 UTC (rev 144666)
+++ trunk/LayoutTests/ChangeLog 2013-03-04 21:44:07 UTC (rev 144667)
@@ -1,3 +1,13 @@
+2013-03-04 Tom Sepez <[email protected]>
+
+ XSSAuditor bypass with --> comment syntax.
+ https://bugs.webkit.org/show_bug.cgi?id=111349
+
+ Reviewed by Adam Barth.
+
+ * http/tests/security/xssAuditor/open-iframe-src-03-expected.txt: Added.
+ * http/tests/security/xssAuditor/open-iframe-src-03.html: Added.
+
2013-03-04 Christian Biesinger <[email protected]>
(tests) flexbox/resources.css should use unprefixed properties, for firefox
Added: trunk/LayoutTests/http/tests/security/xssAuditor/open-iframe-src-03-expected.txt (0 => 144667)
--- trunk/LayoutTests/http/tests/security/xssAuditor/open-iframe-src-03-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/xssAuditor/open-iframe-src-03-expected.txt 2013-03-04 21:44:07 UTC (rev 144667)
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: line 4: Refused to execute a _javascript_ script. Source code of script found within request.
+
+
Added: trunk/LayoutTests/http/tests/security/xssAuditor/open-iframe-src-03.html (0 => 144667)
--- trunk/LayoutTests/http/tests/security/xssAuditor/open-iframe-src-03.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/xssAuditor/open-iframe-src-03.html 2013-03-04 21:44:07 UTC (rev 144667)
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ testRunner.setXSSAuditorEnabled(true);
+ }
+ </script>
+</head>
+<body>
+ <iframe src=''></iframe>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (144666 => 144667)
--- trunk/Source/WebCore/ChangeLog 2013-03-04 21:42:03 UTC (rev 144666)
+++ trunk/Source/WebCore/ChangeLog 2013-03-04 21:44:07 UTC (rev 144667)
@@ -1,3 +1,17 @@
+2013-03-04 Tom Sepez <[email protected]>
+
+ XSSAuditor bypass with --> comment syntax.
+ https://bugs.webkit.org/show_bug.cgi?id=111349
+
+ Reviewed by Adam Barth.
+
+ Test: http/tests/security/xssAuditor/open-iframe-src-03.html
+
+ * html/parser/XSSAuditor.cpp:
+ (WebCore::isTerminatingCharacter):
+ Adds ">" to the list of terminating characters, so that comments of
+ the form --> end the snippet we seek to match.
+
2013-03-04 Vsevolod Vlasov <[email protected]>
Web Inspector: Modal dialogs sometimes lose focus.
Modified: trunk/Source/WebCore/html/parser/XSSAuditor.cpp (144666 => 144667)
--- trunk/Source/WebCore/html/parser/XSSAuditor.cpp 2013-03-04 21:42:03 UTC (rev 144666)
+++ trunk/Source/WebCore/html/parser/XSSAuditor.cpp 2013-03-04 21:44:07 UTC (rev 144667)
@@ -88,7 +88,7 @@
static bool isTerminatingCharacter(UChar c)
{
- return (c == '&' || c == '/' || c == '"' || c == '\'' || c == '<');
+ return (c == '&' || c == '/' || c == '"' || c == '\'' || c == '<' || c == '>');
}
static bool isHTMLQuote(UChar c)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
