[webkit-changes] [145632] branches/safari-536.30-branch

Tue, 12 Mar 2013 17:25:15 -0700

Title: [145632] branches/safari-536.30-branch

Diff

Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145631 => 145632)


--- branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-03-13 00:25:45 UTC (rev 145631)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-03-13 00:27:13 UTC (rev 145632)
@@ -1,5 +1,19 @@
 2013-03-12  Lucas Forschler  <[email protected]>
 
+        Merge r136061
+
+    2012-11-28  Tom Sepez  <[email protected]>
+
+            XSSAuditor bypass with script src="" URL ending in <!--
+            https://bugs.webkit.org/show_bug.cgi?id=103548
+
+            Reviewed by Adam Barth.
+
+            * http/tests/security/xssAuditor/script-tag-with-source-data-url3-expected.txt: Added.
+            * http/tests/security/xssAuditor/script-tag-with-source-data-url3.html: Added.
+
+2013-03-12  Lucas Forschler  <[email protected]>
+
         Merge r136060
 
     2012-11-28  Abhishek Arya  <[email protected]>

Copied: branches/safari-536.30-branch/LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-data-url3-expected.txt (from rev 136061, trunk/LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-data-url3-expected.txt) (0 => 145632)


--- branches/safari-536.30-branch/LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-data-url3-expected.txt	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-data-url3-expected.txt	2013-03-13 00:27:13 UTC (rev 145632)
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: Refused to execute a _javascript_ script. Source code of script found within request.
+
+

Copied: branches/safari-536.30-branch/LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-data-url3.html (from rev 136061, trunk/LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-data-url3.html) (0 => 145632)


--- branches/safari-536.30-branch/LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-data-url3.html	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-data-url3.html	2013-03-13 00:27:13 UTC (rev 145632)
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.setXSSAuditorEnabled(true);
+}
+</script>
+</head>
+<body>
+<iframe src=""
+</iframe>
+</body>
+</html>

Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145631 => 145632)


--- branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-13 00:25:45 UTC (rev 145631)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-13 00:27:13 UTC (rev 145632)
@@ -1,5 +1,26 @@
 2013-03-12  Lucas Forschler  <[email protected]>
 
+        Merge r136061
+
+    2012-11-28  Tom Sepez  <[email protected]>
+
+            XSSAuditor bypass with script src="" URL ending in <!--
+            https://bugs.webkit.org/show_bug.cgi?id=103548
+
+            Reviewed by Adam Barth.
+
+            This fixes an additional case where characters from the page itself are
+            included with the snippet to match against the reflected vector, and the
+            JS remains legitimate because of a <!--- comment. Truncate the snippet at
+            such a comment.
+
+            Test: http/tests/security/xssAuditor/script-tag-with-source-data-url3.html
+
+            * html/parser/XSSAuditor.cpp:
+            (WebCore::XSSAuditor::decodedSnippetForAttribute):
+
+2013-03-12  Lucas Forschler  <[email protected]>
+
         Merge r136060
 
     2012-11-28  Abhishek Arya  <[email protected]>

Modified: branches/safari-536.30-branch/Source/WebCore/html/parser/XSSAuditor.cpp (145631 => 145632)


--- branches/safari-536.30-branch/Source/WebCore/html/parser/XSSAuditor.cpp	2013-03-13 00:25:45 UTC (rev 145631)
+++ branches/safari-536.30-branch/Source/WebCore/html/parser/XSSAuditor.cpp	2013-03-13 00:27:13 UTC (rev 145632)
@@ -493,13 +493,16 @@
         // In HTTP URLs, characters following the first ?, #, or third slash may come from 
         // the page itself and can be merely ignored by an attacker's server when a remote
         // script or script-like resource is requested. In DATA URLS, the payload starts at
-        // the first comma, and the the first /* or // may introduce a comment. Characters
+        // the first comma, and the the first /*, //, or <!-- may introduce a comment. Characters
         // following this may come from the page itself and may be ignored when the script is
         // executed. For simplicity, we don't differentiate based on URL scheme, and stop at
-        // the first # or ?, the third slash, or the first slash once a comma is seen.
+        // the first # or ?, the third slash, or the first slash or < once a comma is seen.
         for (size_t currentLength = 0; currentLength < decodedSnippet.length(); ++currentLength) {
             UChar currentChar = decodedSnippet[currentLength];
-            if (currentChar == '?' || currentChar == '#' || ((currentChar == '/' || currentChar == '\\') && (commaSeen || ++slashCount > 2))) {
+            if (currentChar == '?'
+                || currentChar == '#'
+                || ((currentChar == '/' || currentChar == '\\') && (commaSeen || ++slashCount > 2))
+                || (currentChar == '<' && commaSeen)) {
                 decodedSnippet.truncate(currentLength);
                 break;
             }

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to