Title: [195261] releases/WebKitGTK/webkit-2.10
- Revision
- 195261
- Author
- [email protected]
- Date
- 2016-01-19 00:29:05 -0800 (Tue, 19 Jan 2016)
Log Message
Merge r194979 - [XSS Auditor] Do not include trailing comment characters in _javascript_ snippets
https://bugs.webkit.org/show_bug.cgi?id=152873
Patch by Daniel Bates <[email protected]> on 2016-01-13
Reviewed by Brent Fulgham.
Merged from Blink (patch by Tom Sepez <[email protected]>):
<https://src.chromium.org/viewvc/blink?view=rev&revision=169967>
Source/WebCore:
Test: http/tests/security/xssAuditor/script-tag-with-injected-comment.html
* html/parser/XSSAuditor.cpp:
(WebCore::XSSAuditor::decodedSnippetForJavaScript):
LayoutTests:
* http/tests/security/xssAuditor/script-tag-with-injected-comment-expected.txt: Added.
* http/tests/security/xssAuditor/script-tag-with-injected-comment.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog (195260 => 195261)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 08:28:45 UTC (rev 195260)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 08:29:05 UTC (rev 195261)
@@ -1,5 +1,18 @@
2016-01-13 Daniel Bates <[email protected]>
+ [XSS Auditor] Do not include trailing comment characters in _javascript_ snippets
+ https://bugs.webkit.org/show_bug.cgi?id=152873
+
+ Reviewed by Brent Fulgham.
+
+ Merged from Blink (patch by Tom Sepez <[email protected]>):
+ <https://src.chromium.org/viewvc/blink?view=rev&revision=169967>
+
+ * http/tests/security/xssAuditor/script-tag-with-injected-comment-expected.txt: Added.
+ * http/tests/security/xssAuditor/script-tag-with-injected-comment.html: Added.
+
+2016-01-13 Daniel Bates <[email protected]>
+
[XSS Auditor] Add test when XSS payload is in the path portion of the URL
https://bugs.webkit.org/show_bug.cgi?id=152871
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/script-tag-with-injected-comment-expected.txt (0 => 195261)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/script-tag-with-injected-comment-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/script-tag-with-injected-comment-expected.txt 2016-01-19 08:29:05 UTC (rev 195261)
@@ -0,0 +1,2 @@
+CONSOLE MESSAGE: line 4: The XSS Auditor refused to execute a script in 'http://localhost:8000/security/xssAuditor/resources/echo-intertag.pl?clutter=/*]]%3E*/&q=%3Cscript%3E/*%3C!CDATA[*/alert(/XSS/)&q2=%3C/script%3E' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.
+
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/script-tag-with-injected-comment.html (0 => 195261)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/script-tag-with-injected-comment.html (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/script-tag-with-injected-comment.html 2016-01-19 08:29:05 UTC (rev 195261)
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.setXSSAuditorEnabled(true);
+}
+</script>
+</head>
+<body>
+<iframe src=""
+</iframe>
+</body>
+</html>
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog (195260 => 195261)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-19 08:28:45 UTC (rev 195260)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-19 08:29:05 UTC (rev 195261)
@@ -1,3 +1,18 @@
+2016-01-13 Daniel Bates <[email protected]>
+
+ [XSS Auditor] Do not include trailing comment characters in _javascript_ snippets
+ https://bugs.webkit.org/show_bug.cgi?id=152873
+
+ Reviewed by Brent Fulgham.
+
+ Merged from Blink (patch by Tom Sepez <[email protected]>):
+ <https://src.chromium.org/viewvc/blink?view=rev&revision=169967>
+
+ Test: http/tests/security/xssAuditor/script-tag-with-injected-comment.html
+
+ * html/parser/XSSAuditor.cpp:
+ (WebCore::XSSAuditor::decodedSnippetForJavaScript):
+
2016-01-13 Said Abou-Hallawa <[email protected]>
Reference cycle between SVGPathElement and SVGPathSegWithContext leaks Document
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/html/parser/XSSAuditor.cpp (195260 => 195261)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/html/parser/XSSAuditor.cpp 2016-01-19 08:28:45 UTC (rev 195260)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/html/parser/XSSAuditor.cpp 2016-01-19 08:29:05 UTC (rev 195261)
@@ -669,14 +669,11 @@
lastNonSpacePosition = notFound;
for (foundPosition = startPosition; foundPosition < endPosition; foundPosition++) {
if (!request.shouldAllowCDATA) {
- if (startsSingleLineCommentAt(string, foundPosition) || startsMultiLineCommentAt(string, foundPosition)) {
- foundPosition += 2;
+ if (startsSingleLineCommentAt(string, foundPosition)
+ || startsMultiLineCommentAt(string, foundPosition)
+ || startsHTMLCommentAt(string, foundPosition)) {
break;
}
- if (startsHTMLCommentAt(string, foundPosition)) {
- foundPosition += 4;
- break;
- }
}
if (string[foundPosition] == ',')
break;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
