185103 2018-04-27 19:43:10 -0700 [GTK] Webkit should spoof as Safari on a Mac when on Chase.com 2018-04-30 08:16:21 -0700 1 1 1 Unclassified WebKit WebKitGTK Other PC Linux RESOLVED FIXED P2 Normal --- 1 rfarmer84 mcatanzaro bugs-noreply cgarcia commit-queue ews-watchlist mcatanzaro oldest_to_newest 1418730 0 rfarmer84 2018-04-27 19:43:10 -0700 [GTK] Webkit should spoof as Safari on a Mac when on Chase.com When given the default user agent for GNOME Web, Chase gives the user an "upgrade your browser" nag screen, and then when logged in, it gives you a crappy fallback site for obsolete web browsers. Boo! I think we have more of a shot at finding Jimmy Hoffa than convincing one of the largest US banks to quit demanding that we use another web browser. Safari 11.1 on Mac OS X user agent results in normal online banking site and everything seems to work. 1418821 1 mcatanzaro 2018-04-28 14:58:58 -0700 OK 1418921 2 mcatanzaro 2018-04-29 14:41:56 -0700 I tested this and the quirk doesn't work. The problem also doesn't occur in MiniBrowser. Chase seems to be checking the final component of the user agent (Epiphany/605.1.15). 1418922 3 mcatanzaro 2018-04-29 14:50:40 -0700 (In reply to Michael Catanzaro from comment #2) > I tested this and the quirk doesn't work. Hm, maybe I forgot to build or something. It works fine. 1418923 4 339099 mcatanzaro 2018-04-29 14:54:45 -0700 Created attachment 339099 Patch 1418924 5 ews-watchlist 2018-04-29 14:56:28 -0700 Attachment 339099 did not pass style-queue: ERROR: Tools/ChangeLog:3: Please consider whether the use of security-sensitive phrasing could help someone exploit WebKit: spoof [changelog/unwantedsecurityterms] [3] ERROR: Source/WebCore/ChangeLog:3: Please consider whether the use of security-sensitive phrasing could help someone exploit WebKit: spoof [changelog/unwantedsecurityterms] [3] Total errors found: 2 in 4 files If any of these errors are false positives, please file a bug against check-webkit-style. 1418974 6 339099 commit-queue 2018-04-30 08:16:20 -0700 Comment on attachment 339099 Patch Clearing flags on attachment: 339099 Committed r231156: <https://trac.webkit.org/changeset/231156> 1418975 7 commit-queue 2018-04-30 08:16:21 -0700 All reviewed patches have been landed. Closing bug. 339099 2018-04-29 14:54:45 -0700 2018-04-30 08:16:20 -0700 Patch bug-185103-20180429165445.patch text/plain 3478 mcatanzaro U3VidmVyc2lvbiBSZXZpc2lvbjogMjMxMTUwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNjJhMDM0MDExZTBhYWFk OTBiYjVhOWE1ZGIxZGFjODgwODQzMDRmZi4uMjAxM2ZlYTAxZTBiNTZiMDU3Zjg1OTQyYzA2MDZj MDJiNDcyYTk0MSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDE4LTA0LTI5ICBNaWNo YWVsIENhdGFuemFybyAgPG1jYXRhbnphcm9AaWdhbGlhLmNvbT4KKworICAgICAgICBbR1RLXSBX ZWJraXQgc2hvdWxkIHNwb29mIGFzIFNhZmFyaSBvbiBhIE1hYyB3aGVuIG9uIENoYXNlLmNvbQor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTg1MTAzCisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgU2VuZCBhIGZh a2UgdXNlciBhZ2VudCB0byBjaGFzZS5jb20gdG8gbWFrZSBpdCB3b3JrLgorCisgICAgICAgICog cGxhdGZvcm0vVXNlckFnZW50UXVpcmtzLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OnVybFJlcXVp cmVzTWFjaW50b3NoUGxhdGZvcm0pOgorICAgICAgICAoV2ViQ29yZTo6VXNlckFnZW50UXVpcmtz OjpzdHJpbmdGb3JRdWlyayk6IEFsc28sIHJlbW92ZSB0aGlzIHN0YWxlIGNvbW1lbnQuCisKIDIw MTgtMDQtMjkgIFphbGFuIEJ1anRhcyAgPHphbGFuQGFwcGxlLmNvbT4KIAogICAgICAgICBbTEZD XSBJbXBsZW1lbnQgRGlzcGxheTo6Qm94IGZ1bmN0aW9ucwpkaWZmIC0tZ2l0IGEvU291cmNlL1dl YkNvcmUvcGxhdGZvcm0vVXNlckFnZW50UXVpcmtzLmNwcCBiL1NvdXJjZS9XZWJDb3JlL3BsYXRm b3JtL1VzZXJBZ2VudFF1aXJrcy5jcHAKaW5kZXggZTM0NzQyNmE5YzEzODE5ODQ0NGQ3ZWNhMWYz OWJjODM3ZWQyY2Y3MS4uMWZiMmIxYzM2M2M3YjA0OWVmZjFhMWM4ZmU5Njg5NTA3Yjc2NjkzNCAx MDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vVXNlckFnZW50UXVpcmtzLmNwcAor KysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9Vc2VyQWdlbnRRdWlya3MuY3BwCkBAIC05Myw2 ICs5MywxMSBAQCBzdGF0aWMgYm9vbCB1cmxSZXF1aXJlc01hY2ludG9zaFBsYXRmb3JtKGNvbnN0 IFVSTCYgdXJsKQogICAgIGlmIChiYXNlRG9tYWluID09ICJ3aGF0c2FwcC5jb20iKQogICAgICAg ICByZXR1cm4gdHJ1ZTsKIAorICAgIC8vIGNoYXNlLmNvbSBkaXNwbGF5cyBhIGh1Z2UgInBsZWFz ZSB1cGRhdGUgeW91ciBicm93c2VyIiB3YXJuaW5nIHdpdGgKKyAgICAvLyBXZWJLaXRHVEsrJ3Mg c3RhbmRhcmQgdXNlciBhZ2VudC4KKyAgICBpZiAoYmFzZURvbWFpbiA9PSAiY2hhc2UuY29tIikK KyAgICAgICAgcmV0dXJuIHRydWU7CisKICAgICAvLyBNaWNyb3NvZnQgT3V0bG9vayBXZWIgQXBw IGZvcmNlcyB1c2VycyB3aXRoIFdlYktpdEdUSysncyBzdGFuZGFyZCB1c2VyCiAgICAgLy8gYWdl bnQgdG8gdXNlIHRoZSBsaWdodCB2ZXJzaW9uLiBFYXJsaWVyIHZlcnNpb25zIGV2ZW4gYmxvY2tz IHVzZXJzIGZyb20KICAgICAvLyBhY2Nlc3NpbmcgdGhlIGNhbGVuZGFyLgpAQCAtMTMzLDcgKzEz OCw2IEBAIFN0cmluZyBVc2VyQWdlbnRRdWlya3M6OnN0cmluZ0ZvclF1aXJrKFVzZXJBZ2VudFF1 aXJrIHF1aXJrKQogICAgICAgICAvLyBHZXQgdmVyc2lvbnMgZnJvbSBodHRwczovL2Nocm9taXVt Lmdvb2dsZXNvdXJjZS5jb20vY2hyb21pdW0vc3JjLmdpdAogICAgICAgICByZXR1cm4gQVNDSUlM aXRlcmFsKCJDaHJvbWUvNTguMC4zMDI5LjgxIik7CiAgICAgY2FzZSBOZWVkc01hY2ludG9zaFBs YXRmb3JtOgotICAgICAgICAvLyBGcm96ZW4gcGVyIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD0xODAzNjUKICAgICAgICAgcmV0dXJuIEFTQ0lJTGl0ZXJhbCgiTWFjaW50 b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xM180Iik7CiAgICAgY2FzZSBOZWVkc0xpbnV4RGVza3Rv cFBsYXRmb3JtOgogICAgICAgICByZXR1cm4gQVNDSUlMaXRlcmFsKCJYMTE7IExpbnV4IHg4Nl82 NCIpOwpkaWZmIC0tZ2l0IGEvVG9vbHMvQ2hhbmdlTG9nIGIvVG9vbHMvQ2hhbmdlTG9nCmluZGV4 IDVmNzk0NDA3NTdkNDNiYmMyYTUzMzY3NjQ0NTY5ZGRmZjI3ODc0MWEuLjQwNGNlNDE2MjU3NWY1 YTgzNGQ1NzNkYTQ4N2VjYjhmODNiOGQ0MDIgMTAwNjQ0Ci0tLSBhL1Rvb2xzL0NoYW5nZUxvZwor KysgYi9Ub29scy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAxOC0wNC0yOSAgTWljaGFl bCBDYXRhbnphcm8gIDxtY2F0YW56YXJvQGlnYWxpYS5jb20+CisKKyAgICAgICAgW0dUS10gV2Vi a2l0IHNob3VsZCBzcG9vZiBhcyBTYWZhcmkgb24gYSBNYWMgd2hlbiBvbiBDaGFzZS5jb20KKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE4NTEwMworCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogVGVzdFdlYktp dEFQSS9UZXN0cy9XZWJDb3JlL1VzZXJBZ2VudFF1aXJrcy5jcHA6CisgICAgICAgIChUZXN0V2Vi S2l0QVBJOjpURVNUKToKKwogMjAxOC0wNC0yOCAgU2lodWkgTGl1ICA8c2lodWlfbGl1QGFwcGxl LmNvbT4KIAogICAgICAgICBbQ29jb2FdIFNldCBIVFRQT25seSBmbGFnIHdoZW4gY29udmVydGlu ZyBDb29raWUgdG8gTlNIVFRQQ29va2llCmRpZmYgLS1naXQgYS9Ub29scy9UZXN0V2ViS2l0QVBJ L1Rlc3RzL1dlYkNvcmUvVXNlckFnZW50UXVpcmtzLmNwcCBiL1Rvb2xzL1Rlc3RXZWJLaXRBUEkv VGVzdHMvV2ViQ29yZS9Vc2VyQWdlbnRRdWlya3MuY3BwCmluZGV4IDJhMTc2OWUzZjk3ODdhMzAy NWQxODU0NzllYWI1ZThhOTY4NzQ4ODkuLmJkYWIzZGM4ZDg5Zjk4ZjZlYTlmMmZlZTU2NWM1MDZm YmY4MWUxN2YgMTAwNjQ0Ci0tLSBhL1Rvb2xzL1Rlc3RXZWJLaXRBUEkvVGVzdHMvV2ViQ29yZS9V c2VyQWdlbnRRdWlya3MuY3BwCisrKyBiL1Rvb2xzL1Rlc3RXZWJLaXRBUEkvVGVzdHMvV2ViQ29y ZS9Vc2VyQWdlbnRRdWlya3MuY3BwCkBAIC05Myw2ICs5Myw3IEBAIFRFU1QoVXNlckFnZW50VGVz dCwgUXVpcmtzKQogICAgIGFzc2VydFVzZXJBZ2VudEZvclVSTEhhc01hY1BsYXRmb3JtUXVpcmso Imh0dHA6Ly93d3cud2hhdHNhcHAuY29tLyIpOwogICAgIGFzc2VydFVzZXJBZ2VudEZvclVSTEhh c01hY1BsYXRmb3JtUXVpcmsoImh0dHA6Ly93ZWIud2hhdHNhcHAuY29tLyIpOwogICAgIGFzc2Vy dFVzZXJBZ2VudEZvclVSTEhhc01hY1BsYXRmb3JtUXVpcmsoImh0dHA6Ly9vdXRsb29rLmxpdmUu Y29tLyIpOworICAgIGFzc2VydFVzZXJBZ2VudEZvclVSTEhhc01hY1BsYXRmb3JtUXVpcmsoImh0 dHA6Ly93d3cuY2hhc2UuY29tLyIpOwogfQogCiB9IC8vIG5hbWVzcGFjZSBUZXN0V2ViS2l0QVBJ Cg==