Title: [195262] releases/WebKitGTK/webkit-2.10/Source/WebCore
- Revision
- 195262
- Author
- [email protected]
- Date
- 2016-01-19 00:29:54 -0800 (Tue, 19 Jan 2016)
Log Message
Merge r194982 - Cleanup: XSS Auditor should avoid re-evaluating the parsed script tag
https://bugs.webkit.org/show_bug.cgi?id=152870
Patch by Daniel Bates <[email protected]> on 2016-01-13
Reviewed by Brent Fulgham.
Merged from Blink (patch by Tom Sepez <[email protected]>):
<https://src.chromium.org/viewvc/blink?revision=154354&view=revision>
Although the XSS Auditor caches the decoded start tag of a script as an optimization to
avoid decoding it again when filtering the character data of the script, it is sufficient
to cache whether the HTTP response contains the decoded start tag of a script. This
avoids both decoding the start tag of a script and determining whether the HTTP response
contains it again when filtering the character data of the script. Moreover, this removes
the need to cache a string object.
* html/parser/XSSAuditor.cpp:
(WebCore::XSSAuditor::filterCharacterToken):
(WebCore::XSSAuditor::filterScriptToken):
* html/parser/XSSAuditor.h:
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog (195261 => 195262)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-19 08:29:05 UTC (rev 195261)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-19 08:29:54 UTC (rev 195262)
@@ -1,5 +1,27 @@
2016-01-13 Daniel Bates <[email protected]>
+ Cleanup: XSS Auditor should avoid re-evaluating the parsed script tag
+ https://bugs.webkit.org/show_bug.cgi?id=152870
+
+ Reviewed by Brent Fulgham.
+
+ Merged from Blink (patch by Tom Sepez <[email protected]>):
+ <https://src.chromium.org/viewvc/blink?revision=154354&view=revision>
+
+ Although the XSS Auditor caches the decoded start tag of a script as an optimization to
+ avoid decoding it again when filtering the character data of the script, it is sufficient
+ to cache whether the HTTP response contains the decoded start tag of a script. This
+ avoids both decoding the start tag of a script and determining whether the HTTP response
+ contains it again when filtering the character data of the script. Moreover, this removes
+ the need to cache a string object.
+
+ * html/parser/XSSAuditor.cpp:
+ (WebCore::XSSAuditor::filterCharacterToken):
+ (WebCore::XSSAuditor::filterScriptToken):
+ * html/parser/XSSAuditor.h:
+
+2016-01-13 Daniel Bates <[email protected]>
+
[XSS Auditor] Do not include trailing comment characters in _javascript_ snippets
https://bugs.webkit.org/show_bug.cgi?id=152873
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/html/parser/XSSAuditor.cpp (195261 => 195262)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/html/parser/XSSAuditor.cpp 2016-01-19 08:29:05 UTC (rev 195261)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/html/parser/XSSAuditor.cpp 2016-01-19 08:29:54 UTC (rev 195262)
@@ -387,7 +387,7 @@
bool XSSAuditor::filterCharacterToken(const FilterTokenRequest& request)
{
ASSERT(m_scriptTagNestingLevel);
- if (isContainedInRequest(m_cachedDecodedSnippet) && isContainedInRequest(decodedSnippetForJavaScript(request))) {
+ if (m_wasScriptTagFoundInRequest && isContainedInRequest(decodedSnippetForJavaScript(request))) {
request.token.clear();
LChar space = ' ';
request.token.appendToCharacter(space); // Technically, character tokens can't be empty.
@@ -401,10 +401,10 @@
ASSERT(request.token.type() == HTMLToken::StartTag);
ASSERT(hasName(request.token, scriptTag));
- m_cachedDecodedSnippet = decodedSnippetForName(request);
+ m_wasScriptTagFoundInRequest = isContainedInRequest(decodedSnippetForName(request));
bool didBlockScript = false;
- if (isContainedInRequest(decodedSnippetForName(request))) {
+ if (m_wasScriptTagFoundInRequest) {
didBlockScript |= eraseAttributeIfInjected(request, srcAttr, blankURL().string(), SrcLikeAttribute);
didBlockScript |= eraseAttributeIfInjected(request, XLinkNames::hrefAttr, blankURL().string(), SrcLikeAttribute);
}
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/html/parser/XSSAuditor.h (195261 => 195262)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/html/parser/XSSAuditor.h 2016-01-19 08:29:05 UTC (rev 195261)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/html/parser/XSSAuditor.h 2016-01-19 08:29:54 UTC (rev 195262)
@@ -114,7 +114,7 @@
std::unique_ptr<SuffixTree<ASCIICodebook>> m_decodedHTTPBodySuffixTree;
State m_state;
- String m_cachedDecodedSnippet;
+ bool m_wasScriptTagFoundInRequest { false };
unsigned m_scriptTagNestingLevel;
TextEncoding m_encoding;
};
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
