Title: [195260] releases/WebKitGTK/webkit-2.10
- Revision
- 195260
- Author
- [email protected]
- Date
- 2016-01-19 00:28:45 -0800 (Tue, 19 Jan 2016)
Log Message
Merge r194978 - [XSS Auditor] Add test when XSS payload is in the path portion of the URL
https://bugs.webkit.org/show_bug.cgi?id=152871
Patch by Daniel Bates <[email protected]> on 2016-01-13
Reviewed by Brent Fulgham.
Merged from Blink (patch by Tom Sepez <[email protected]>):
<https://src.chromium.org/viewvc/blink?revision=164746&view=revision>
Tools:
* Scripts/webkitpy/layout_tests/servers/lighttpd.conf:
LayoutTests:
Add infrastructure and a test for an XSS attack where the payload is
embedded in the path portion of the URL.
Many XSS Auditor tests pass the XSS payload to CGI scripts via the
query string portion of the URL. Now we also support calling these
same scripts with the payload embedded in the path portion of the
URL.
Loading <http://127.0.0.1:8000/security/xssAuditor/intercept/X/Y>
returns a response whose content is identical to <http://127.0.0.1:8000/security/xssAuditor/resoures/X?q=Y>,
where X is the filename of some CGI script in directory LayoutTests/http/tests/security/xssAuditor/resources
and Y is the XSS payload.
* http/tests/security/xssAuditor/intercept/.htaccess: Added.
* http/tests/security/xssAuditor/reflection-in-path-expected.txt: Added.
* http/tests/security/xssAuditor/reflection-in-path.html: Added.
* http/tests/security/xssAuditor/resources/echo-form-action.pl: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog (195259 => 195260)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 08:26:13 UTC (rev 195259)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 08:28:45 UTC (rev 195260)
@@ -1,3 +1,31 @@
+2016-01-13 Daniel Bates <[email protected]>
+
+ [XSS Auditor] Add test when XSS payload is in the path portion of the URL
+ https://bugs.webkit.org/show_bug.cgi?id=152871
+
+ Reviewed by Brent Fulgham.
+
+ Merged from Blink (patch by Tom Sepez <[email protected]>):
+ <https://src.chromium.org/viewvc/blink?revision=164746&view=revision>
+
+ Add infrastructure and a test for an XSS attack where the payload is
+ embedded in the path portion of the URL.
+
+ Many XSS Auditor tests pass the XSS payload to CGI scripts via the
+ query string portion of the URL. Now we also support calling these
+ same scripts with the payload embedded in the path portion of the
+ URL.
+
+ Loading <http://127.0.0.1:8000/security/xssAuditor/intercept/X/Y>
+ returns a response whose content is identical to <http://127.0.0.1:8000/security/xssAuditor/resoures/X?q=Y>,
+ where X is the filename of some CGI script in directory LayoutTests/http/tests/security/xssAuditor/resources
+ and Y is the XSS payload.
+
+ * http/tests/security/xssAuditor/intercept/.htaccess: Added.
+ * http/tests/security/xssAuditor/reflection-in-path-expected.txt: Added.
+ * http/tests/security/xssAuditor/reflection-in-path.html: Added.
+ * http/tests/security/xssAuditor/resources/echo-form-action.pl: Added.
+
2016-01-12 Daniel Bates <[email protected]>
XSS Auditor should navigate to empty substitute data on full page block
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/intercept/.htaccess (0 => 195260)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/intercept/.htaccess (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/intercept/.htaccess 2016-01-19 08:28:45 UTC (rev 195260)
@@ -0,0 +1,2 @@
+RewriteEngine on
+RewriteRule ^(.*)/(.*) /security/xssAuditor/resources/$1?q=$2 [L,NS]
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path-expected.txt (0 => 195260)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path-expected.txt 2016-01-19 08:28:45 UTC (rev 195260)
@@ -0,0 +1,9 @@
+CONSOLE MESSAGE: line 5: The XSS Auditor refused to execute a script in 'http://localhost:8000/security/xssAuditor/intercept/echo-form-action.pl/%22%20onmouseover=%22JavaScript:alert(document.domain)%22%20name=%22?m=login' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.
+
+
+--------
+Frame: '<!--framePath //<!--frame0-->-->'
+--------
+This is an iframe with a injected form
+
+
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path.html (0 => 195260)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path.html (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path.html 2016-01-19 08:28:45 UTC (rev 195260)
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.dumpChildFramesAsText();
+ testRunner.setXSSAuditorEnabled(true);
+ testRunner.waitUntilDone();
+}
+</script>
+</head>
+<body>
+<iframe src=""
+</body>
+</html>
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/resources/echo-form-action.pl (0 => 195260)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/resources/echo-form-action.pl (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/resources/echo-form-action.pl 2016-01-19 08:28:45 UTC (rev 195260)
@@ -0,0 +1,16 @@
+#!/usr/bin/perl -wT
+use strict;
+use CGI;
+
+my $cgi = new CGI;
+
+print "Content-Type: text/html; charset=UTF-8\n\n";
+
+print "<!DOCTYPE html>\n";
+print "<html>\n";
+print "<body>\n";
+print "<p>This is an iframe with a injected form</p>\n";
+print "<form method=\"post\" id=\"login\" action=""
+print "<script>if (window.testRunner) testRunner.notifyDone();</script>\n";
+print "</body>\n";
+print "</html>\n";
Property changes on: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/resources/echo-form-action.pl
___________________________________________________________________
Added: svn:executable
Modified: releases/WebKitGTK/webkit-2.10/Tools/ChangeLog (195259 => 195260)
--- releases/WebKitGTK/webkit-2.10/Tools/ChangeLog 2016-01-19 08:26:13 UTC (rev 195259)
+++ releases/WebKitGTK/webkit-2.10/Tools/ChangeLog 2016-01-19 08:28:45 UTC (rev 195260)
@@ -1,3 +1,15 @@
+2016-01-13 Daniel Bates <[email protected]>
+
+ [XSS Auditor] Add test when XSS payload is in the path portion of the URL
+ https://bugs.webkit.org/show_bug.cgi?id=152871
+
+ Reviewed by Brent Fulgham.
+
+ Merged from Blink (patch by Tom Sepez <[email protected]>):
+ <https://src.chromium.org/viewvc/blink?revision=164746&view=revision>
+
+ * Scripts/webkitpy/layout_tests/servers/lighttpd.conf:
+
2016-01-01 Michael Catanzaro <[email protected]>
[SOUP] REGRESSION(r192761): Broke resource URIs for applications that use g_resource_load in a web extension
Modified: releases/WebKitGTK/webkit-2.10/Tools/Scripts/webkitpy/layout_tests/servers/lighttpd.conf (195259 => 195260)
--- releases/WebKitGTK/webkit-2.10/Tools/Scripts/webkitpy/layout_tests/servers/lighttpd.conf 2016-01-19 08:26:13 UTC (rev 195259)
+++ releases/WebKitGTK/webkit-2.10/Tools/Scripts/webkitpy/layout_tests/servers/lighttpd.conf 2016-01-19 08:28:45 UTC (rev 195260)
@@ -65,7 +65,8 @@
# LayoutTests/http/tests/appcache/resources/intercept/.htaccess
url.rewrite-_once_ = (
"^/uri/intercept/(.*)" => "/uri/resources/print-uri.php",
- "^/appcache/resources/intercept/(.*)" => "/appcache/resources/print-uri.php"
+ "^/appcache/resources/intercept/(.*)" => "/appcache/resources/print-uri.php",
+ "^/security/xssAuditor/intercept/([^/]*)/(.*)" => "/security/xssAuditor/resources/$1?q=$2"
)
# LayoutTests/http/tests/xmlhttprequest/response-encoding.html uses an htaccess
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
