<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>161937</bug_id>
          
          <creation_ts>2016-09-13 17:15:04 -0700</creation_ts>
          <short_desc>[XSS Auditor] Truncate data URLs at quotes</short_desc>
          <delta_ts>2016-09-22 14:35:42 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebCore Misc.</component>
          <version>WebKit Local Build</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>BlinkMergeCandidate</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>161939</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="Daniel Bates">dbates</reporter>
          <assigned_to name="Daniel Bates">dbates</assigned_to>
          <cc>aestes</cc>
    
    <cc>bfulgham</cc>
    
    <cc>cdumez</cc>
    
    <cc>commit-queue</cc>
    
    <cc>ddkilzer</cc>
    
    <cc>esprehn+autocc</cc>
    
    <cc>gyuyoung.kim</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1229391</commentid>
    <comment_count>0</comment_count>
    <who name="Daniel Bates">dbates</who>
    <bug_when>2016-09-13 17:15:04 -0700</bug_when>
    <thetext>We should merge &lt;https://chromium.googlesource.com/chromium/src/+/c6d6331190dd43f09459e2341c3111e796f9de12%5E%21/#F3&gt;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1229399</commentid>
    <comment_count>1</comment_count>
      <attachid>288756</attachid>
    <who name="Daniel Bates">dbates</who>
    <bug_when>2016-09-13 17:52:53 -0700</bug_when>
    <thetext>Created attachment 288756
Patch and Layout Test</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1232623</commentid>
    <comment_count>2</comment_count>
      <attachid>288756</attachid>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2016-09-22 14:28:08 -0700</bug_when>
    <thetext>Comment on attachment 288756
Patch and Layout Test

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1232628</commentid>
    <comment_count>3</comment_count>
      <attachid>288756</attachid>
    <who name="Daniel Bates">dbates</who>
    <bug_when>2016-09-22 14:35:37 -0700</bug_when>
    <thetext>Comment on attachment 288756
Patch and Layout Test

Clearing flags on attachment: 288756

Committed r206276: &lt;http://trac.webkit.org/changeset/206276&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1232629</commentid>
    <comment_count>4</comment_count>
    <who name="Daniel Bates">dbates</who>
    <bug_when>2016-09-22 14:35:42 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>288756</attachid>
            <date>2016-09-13 17:52:53 -0700</date>
            <delta_ts>2016-09-22 14:35:37 -0700</delta_ts>
            <desc>Patch and Layout Test</desc>
            <filename>bug-161937-20160913175018.patch</filename>
            <type>text/plain</type>
            <size>6255</size>
            <attacher name="Daniel Bates">dbates</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjA1ODg3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOGY0MzBlYzE5NGNlN2Iy
MDJmNGI2MGUwZTAxOTllYjk2NTU2OGFiMy4uZjUyNjhiZjZkODdhNmFlNzJhZGZiMTRjYWZkZGJh
M2VlZmQ1MTAzNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIxIEBACisyMDE2LTA5LTEzICBEYW5p
ZWwgQmF0ZXMgIDxkYWJhdGVzQGFwcGxlLmNvbT4KKworICAgICAgICBbWFNTIEF1ZGl0b3JdIFRy
dW5jYXRlIGRhdGEgVVJMcyBhdCBxdW90ZXMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v
cmcvc2hvd19idWcuY2dpP2lkPTE2MTkzNworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo
T09QUyEpLgorCisgICAgICAgIE1lcmdlZCBmcm9tIEJsaW5rOiAKKyAgICAgICAgPGh0dHBzOi8v
Y2hyb21pdW0uZ29vZ2xlc291cmNlLmNvbS9jaHJvbWl1bS9zcmMvKy9jNmQ2MzMxMTkwZGQ0M2Yw
OTQ1OWUyMzQxYzMxMTFlNzk2ZjlkZTEyLz4KKworICAgICAgICBUcnVuY2F0ZSBhIGRhdGEgVVJM
IGF0IHRoZSBmaXJzdCBzaW5nbGUgb3IgZG91YmxlIHF1b3RlIGNoYXJhY3RlciB0byBhdm9pZCBj
b25zaWRlcmluZworICAgICAgICBjaGFyYWN0ZXJzIHRoYXQgbWF5IGNvbWUgZnJvbSB0aGUgcGFn
ZSBjb250ZW50IGZvbGxvd2luZyBhbiBpbmplY3RlZCBkYXRhIFVSTC4KKworICAgICAgICBUZXN0
OiBodHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRhZy13aXRoLXNvdXJjZS1k
YXRhLXVybDQuaHRtbAorCisgICAgICAgICogaHRtbC9wYXJzZXIvWFNTQXVkaXRvci5jcHA6Cisg
ICAgICAgIChXZWJDb3JlOjp0cnVuY2F0ZUZvclNyY0xpa2VBdHRyaWJ1dGUpOgorCiAyMDE2LTA5
LTEzICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAgICAgTWVyZ2UgRWxl
bWVudDo6U2Nyb2xsVG9PcHRpb25zIGFuZCBET01XaW5kb3c6OlNjcm9sbFRvT3B0aW9ucwpkaWZm
IC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvWFNTQXVkaXRvci5jcHAgYi9Tb3Vy
Y2UvV2ViQ29yZS9odG1sL3BhcnNlci9YU1NBdWRpdG9yLmNwcAppbmRleCAwMjJmZTQyMDA5NTQy
OWYyMGI5NzkxOGEzMGM0Y2RhNTJkNGYxNmJhLi5kOWFmZmY0ZjAyMDA4ZDEwOWY5NzUyYTA2Zjli
Y2NkZWZmMzZlMzJiIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9YU1NB
dWRpdG9yLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9YU1NBdWRpdG9yLmNw
cApAQCAtMTc4LDExICsxNzgsMTQgQEAgc3RhdGljIHZvaWQgdHJ1bmNhdGVGb3JTcmNMaWtlQXR0
cmlidXRlKFN0cmluZyYgZGVjb2RlZFNuaXBwZXQpCiB7CiAgICAgLy8gSW4gSFRUUCBVUkxzLCBj
aGFyYWN0ZXJzIGZvbGxvd2luZyB0aGUgZmlyc3QgPywgIywgb3IgdGhpcmQgc2xhc2ggbWF5IGNv
bWUgZnJvbQogICAgIC8vIHRoZSBwYWdlIGl0c2VsZiBhbmQgY2FuIGJlIG1lcmVseSBpZ25vcmVk
IGJ5IGFuIGF0dGFja2VyJ3Mgc2VydmVyIHdoZW4gYSByZW1vdGUKLSAgICAvLyBzY3JpcHQgb3Ig
c2NyaXB0LWxpa2UgcmVzb3VyY2UgaXMgcmVxdWVzdGVkLiBJbiBEQVRBIFVSTFMsIHRoZSBwYXls
b2FkIHN0YXJ0cyBhdAotICAgIC8vIHRoZSBmaXJzdCBjb21tYSwgYW5kIHRoZSB0aGUgZmlyc3Qg
LyosIC8vLCBvciA8IS0tIG1heSBpbnRyb2R1Y2UgYSBjb21tZW50LiBDaGFyYWN0ZXJzCi0gICAg
Ly8gZm9sbG93aW5nIHRoaXMgbWF5IGNvbWUgZnJvbSB0aGUgcGFnZSBpdHNlbGYgYW5kIG1heSBi
ZSBpZ25vcmVkIHdoZW4gdGhlIHNjcmlwdCBpcwotICAgIC8vIGV4ZWN1dGVkLiBGb3Igc2ltcGxp
Y2l0eSwgd2UgZG9uJ3QgZGlmZmVyZW50aWF0ZSBiYXNlZCBvbiBVUkwgc2NoZW1lLCBhbmQgc3Rv
cCBhdAotICAgIC8vIHRoZSBmaXJzdCAjIG9yID8sIHRoZSB0aGlyZCBzbGFzaCwgb3IgdGhlIGZp
cnN0IHNsYXNoIG9yIDwgb25jZSBhIGNvbW1hIGlzIHNlZW4uCisgICAgLy8gc2NyaXB0IG9yIHNj
cmlwdC1saWtlIHJlc291cmNlIGlzIHJlcXVlc3RlZC4gSW4gZGF0YSBVUkxzLCB0aGUgcGF5bG9h
ZCBzdGFydHMgYXQKKyAgICAvLyB0aGUgZmlyc3QgY29tbWEsIGFuZCB0aGUgZmlyc3QgLyosIC8v
LCBvciA8IS0tIG1heSBpbnRyb2R1Y2UgYSBjb21tZW50LiBBbHNvCisgICAgLy8gZGF0YSBVUkxz
IG1heSB1c2UgdGhlIHNhbWUgc3RyaW5nIGxpdGVyYWwgdHJpY2tzIGFzIHdpdGggc2NyaXB0IGNv
bnRlbnQgaXRzZWxmLgorICAgIC8vIEluIGVpdGhlciBjYXNlLCBjb250ZW50IGZvbGxvd2luZyB0
aGlzIG1heSBjb21lIGZyb20gdGhlIHBhZ2UgYW5kIG1heSBiZSBpZ25vcmVkCisgICAgLy8gd2hl
biB0aGUgc2NyaXB0IGlzIGV4ZWN1dGVkLgorICAgIC8vIEZvciBzaW1wbGljaXR5LCB3ZSBkb24n
dCBkaWZmZXJlbnRpYXRlIGJhc2VkIG9uIFVSTCBzY2hlbWUsIGFuZCBzdG9wIGF0CisgICAgLy8g
dGhlIGZpcnN0ICMgb3IgPywgdGhlIHRoaXJkIHNsYXNoLCBvciB0aGUgZmlyc3Qgc2xhc2gsIDws
ICcsIG9yICIgb25jZSBhIGNvbW1hCisgICAgLy8gaXMgc2Vlbi4KICAgICBpbnQgc2xhc2hDb3Vu
dCA9IDA7CiAgICAgYm9vbCBjb21tYVNlZW4gPSBmYWxzZTsKICAgICBmb3IgKHNpemVfdCBjdXJy
ZW50TGVuZ3RoID0gMDsgY3VycmVudExlbmd0aCA8IGRlY29kZWRTbmlwcGV0Lmxlbmd0aCgpOyAr
K2N1cnJlbnRMZW5ndGgpIHsKQEAgLTE5MCw3ICsxOTMsOSBAQCBzdGF0aWMgdm9pZCB0cnVuY2F0
ZUZvclNyY0xpa2VBdHRyaWJ1dGUoU3RyaW5nJiBkZWNvZGVkU25pcHBldCkKICAgICAgICAgaWYg
KGN1cnJlbnRDaGFyID09ICc/JwogICAgICAgICAgICAgfHwgY3VycmVudENoYXIgPT0gJyMnCiAg
ICAgICAgICAgICB8fCAoKGN1cnJlbnRDaGFyID09ICcvJyB8fCBjdXJyZW50Q2hhciA9PSAnXFwn
KSAmJiAoY29tbWFTZWVuIHx8ICsrc2xhc2hDb3VudCA+IDIpKQotICAgICAgICAgICAgfHwgKGN1
cnJlbnRDaGFyID09ICc8JyAmJiBjb21tYVNlZW4pKSB7CisgICAgICAgICAgICB8fCAoY3VycmVu
dENoYXIgPT0gJzwnICYmIGNvbW1hU2VlbikKKyAgICAgICAgICAgIHx8IChjdXJyZW50Q2hhciA9
PSAnXCcnICYmIGNvbW1hU2VlbikKKyAgICAgICAgICAgIHx8IChjdXJyZW50Q2hhciA9PSAnIicg
JiYgY29tbWFTZWVuKSkgewogICAgICAgICAgICAgZGVjb2RlZFNuaXBwZXQudHJ1bmNhdGUoY3Vy
cmVudExlbmd0aCk7CiAgICAgICAgICAgICByZXR1cm47CiAgICAgICAgIH0KZGlmZiAtLWdpdCBh
L0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCA4MDM4
ZmU2ZTAxYjA4ZGY1MzgwNjk5M2Q4NTczMTBiMmNhZjJhYWRlLi5jMzI5MzI1MjJmMWZhM2RhZDc0
ZWI1N2ExOTFhNDAzMzlkZWQwNWNmIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cK
KysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTYtMDktMTMg
IERhbmllbCBCYXRlcyAgPGRhYmF0ZXNAYXBwbGUuY29tPgorCisgICAgICAgIFtYU1MgQXVkaXRv
cl0gVHJ1bmNhdGUgZGF0YSBVUkxzIGF0IHF1b3RlcworICAgICAgICBodHRwczovL2J1Z3Mud2Vi
a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTYxOTM3CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C
T0RZIChPT1BTISkuCisKKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Iv
cmVzb3VyY2VzL2VjaG8tcHJvcGVydHkucGw6CisgICAgICAgICogaHR0cC90ZXN0cy9zZWN1cml0
eS94c3NBdWRpdG9yL3NjcmlwdC10YWctd2l0aC1zb3VyY2UtZGF0YS11cmw0LWV4cGVjdGVkLnR4
dDogQWRkZWQuCisgICAgICAgICogaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL3Njcmlw
dC10YWctd2l0aC1zb3VyY2UtZGF0YS11cmw0Lmh0bWw6IEFkZGVkLgorCiAyMDE2LTA5LTEzICBN
eWxlcyBDLiBNYXhmaWVsZCAgPG1tYXhmaWVsZEBhcHBsZS5jb20+CiAKICAgICAgICAgW0NvY29h
XSBVbmlmeSBmb250J3MgYXNjZW50LCBkZXNjZW50LCBhbmQgeC1oZWlnaHQgYmV0d2VlbiBtYWNP
UyBhbmQgaU9TCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hz
c0F1ZGl0b3IvcmVzb3VyY2VzL2VjaG8tcHJvcGVydHkucGwgYi9MYXlvdXRUZXN0cy9odHRwL3Rl
c3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3IvcmVzb3VyY2VzL2VjaG8tcHJvcGVydHkucGwKaW5kZXgg
YzYwZTA4MWM1ZGY2YjQwNTEzYjIzZGU2MTNlYTc0YzczMDc2ZDc0NC4uNDljZmFiNzkwMDY1MzIy
NGU5M2EzOTQ3MTY1NjJkZTMxNDdjM2Q4NyAxMDA3NTUKLS0tIGEvTGF5b3V0VGVzdHMvaHR0cC90
ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL3Jlc291cmNlcy9lY2hvLXByb3BlcnR5LnBsCisrKyBi
L0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9yZXNvdXJjZXMvZWNo
by1wcm9wZXJ0eS5wbApAQCAtMTQsNSArMTQsNiBAQCBpZiAoJGNnaS0+cGFyYW0oJ2NsdXR0ZXIn
KSkgewogICAgIHByaW50ICRjZ2ktPnBhcmFtKCdjbHV0dGVyJyk7CiB9CiBwcmludCAiXCI+XG4i
OworcHJpbnQgIjxzY3JpcHQ+dmFyIHkgPSAxMjM7PC9zY3JpcHQ+IjsKIHByaW50ICI8L2JvZHk+
XG4iOwogcHJpbnQgIjwvaHRtbD5cbiI7CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9odHRwL3Rl
c3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRhZy13aXRoLXNvdXJjZS1kYXRhLXVybDQt
ZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9y
L3NjcmlwdC10YWctd2l0aC1zb3VyY2UtZGF0YS11cmw0LWV4cGVjdGVkLnR4dApuZXcgZmlsZSBt
b2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
Li4xN2Q3NDU5MTA1YjAwYmQ1MzhjNGU1ZWVhMGI5NWY3MGI2YjZmY2QxCi0tLSAvZGV2L251bGwK
KysrIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL3NjcmlwdC10
YWctd2l0aC1zb3VyY2UtZGF0YS11cmw0LWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDIgQEAKK0NP
TlNPTEUgTUVTU0FHRTogbGluZSAzOiBUaGUgWFNTIEF1ZGl0b3IgcmVmdXNlZCB0byBleGVjdXRl
IGEgc2NyaXB0IGluICdodHRwOi8vbG9jYWxob3N0OjgwMDAvc2VjdXJpdHkveHNzQXVkaXRvci9y
ZXNvdXJjZXMvZWNoby1wcm9wZXJ0eS5wbD9xPSUyMiUzRSUzQ3NjcmlwdCUyMHNyYyUzZGRhdGE6
LGFsZXJ0KDEpJTNiaGV5JSUyMicgYmVjYXVzZSBpdHMgc291cmNlIGNvZGUgd2FzIGZvdW5kIHdp
dGhpbiB0aGUgcmVxdWVzdC4gVGhlIGF1ZGl0b3Igd2FzIGVuYWJsZWQgYmVjYXVzZSB0aGUgc2Vy
dmVyIGRpZCBub3Qgc2VuZCBhbiAnWC1YU1MtUHJvdGVjdGlvbicgaGVhZGVyLgorCmRpZmYgLS1n
aXQgYS9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRh
Zy13aXRoLXNvdXJjZS1kYXRhLXVybDQuaHRtbCBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2Vj
dXJpdHkveHNzQXVkaXRvci9zY3JpcHQtdGFnLXdpdGgtc291cmNlLWRhdGEtdXJsNC5odG1sCm5l
dyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAuLjA4NTE5ODFkNDkzNDJkZjIxODVjOGE1NDg3ODcyNjM3ZjYxYTkyZTQKLS0tIC9k
ZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Iv
c2NyaXB0LXRhZy13aXRoLXNvdXJjZS1kYXRhLXVybDQuaHRtbApAQCAtMCwwICsxLDE1IEBACis8
IURPQ1RZUEUgaHRtbD4KKzxodG1sPgorPGhlYWQ+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy50ZXN0
UnVubmVyKSB7CisgIHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOworICB0ZXN0UnVubmVyLnNldFhT
U0F1ZGl0b3JFbmFibGVkKHRydWUpOworfQorPC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKzxp
ZnJhbWUgc3JjPSJodHRwOi8vbG9jYWxob3N0OjgwMDAvc2VjdXJpdHkveHNzQXVkaXRvci9yZXNv
dXJjZXMvZWNoby1wcm9wZXJ0eS5wbD9xPSUyMj48c2NyaXB0IHNyYyUzZGRhdGE6LGFsZXJ0KDEp
JTNiaGV5JSUyMiI+Cis8L2lmcmFtZT4KKzwvYm9keT4KKzwvaHRtbD4K
</data>

          </attachment>
      

    </bug>

</bugzilla>