26580 2009-06-20 23:57:07 -0700 Fix to enable XSSAuditor on child windows 2009-06-21 19:40:26 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 dbates abarth abarth dbates oldest_to_newest 127194 0 dbates 2009-06-20 23:57:07 -0700 If XSSAuditor is enabled, then it is only enabled on windows explicitly instantiated by a user through File->New Window or File->New Tab. That is, windows instantiated through a link (i.e. have a target of "_blank") have XSSAuditor disabled. The expected behavior is for XSSAuditor to be enabled on all windows regardless of how they were instantiated. 127199 1 31606 dbates 2009-06-21 00:29:09 -0700 Created attachment 31606 Patch with a test 127200 2 31606 abarth 2009-06-21 00:48:53 -0700 Comment on attachment 31606 Patch with a test Thanks Dan! Below are some minor style nits. I'll fix them before landing the patch. > +XSSAuditor::XSSAuditor(Frame* frame) : m_frame(frame) The ": m_frame" bit should be on the next line. > + layoutTestController.dumpChildFramesAsText(); The test doesn't create any child windows, so this call doesn't do anything. > + var event = document.createEvent('MouseEvent'); > + event.initEvent('click', true, true); > + document.getElementById('anchorLink').dispatchEvent(event); I think the anchor tag has a click() method that would be eaiser, but this does the job. > +if (window.layoutTestController) { > + layoutTestController.notifyDone(); > +} No braces needed for if statements with single-line bodies. 127272 3 abarth 2009-06-21 19:40:26 -0700 Sending LayoutTests/ChangeLog Adding LayoutTests/http/tests/security/xssAuditor/link-opens-new-window-expected.txt Adding LayoutTests/http/tests/security/xssAuditor/link-opens-new-window.html Adding LayoutTests/http/tests/security/xssAuditor/resources/echo-intertag-and-notify.php Sending WebCore/ChangeLog Sending WebCore/page/XSSAuditor.cpp Sending WebCore/page/XSSAuditor.h Transmitting file data ....... Committed revision 44927. 31606 2009-06-21 00:29:09 -0700 2009-06-21 00:48:53 -0700 Patch with a test XSSAuditor-child-window.patch text/plain 6690 dbates SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA0NDkxMCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMjIgQEAKKzIwMDktMDYtMjEgIERhbmllbCBCYXRlcyAgPGRiYXRlc0BpbnR1ZGF0 YS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTI2NTgwCisgICAgICAgIAor ICAgICAgICBGaXggdG8gZW5hYmxlIFhTU0F1ZGl0b3Igb24gY2hpbGQgd2luZG93cy4KKyAgICAg ICAgCisgICAgICAgIFRlc3Q6IGh0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9saW5rLW9w ZW5zLW5ldy13aW5kb3cuaHRtbAorICAgICAgICAKKyAgICAgICAgKiBwYWdlL1hTU0F1ZGl0b3Iu Y3BwOgorICAgICAgICAoV2ViQ29yZTo6WFNTQXVkaXRvcjo6WFNTQXVkaXRvcik6CisgICAgICAg IChXZWJDb3JlOjpYU1NBdWRpdG9yOjppc0VuYWJsZWQpOgorICAgICAgICAoV2ViQ29yZTo6WFNT QXVkaXRvcjo6Y2FuRXZhbHVhdGUpOgorICAgICAgICAoV2ViQ29yZTo6WFNTQXVkaXRvcjo6Y2Fu Q3JlYXRlSW5saW5lRXZlbnRMaXN0ZW5lcik6CisgICAgICAgIChXZWJDb3JlOjpYU1NBdWRpdG9y OjpjYW5Mb2FkRXh0ZXJuYWxTY3JpcHRGcm9tU3JjKToKKyAgICAgICAgKFdlYkNvcmU6OlhTU0F1 ZGl0b3I6OmNhbkxvYWRPYmplY3QpOgorICAgICAgICAqIHBhZ2UvWFNTQXVkaXRvci5oOiBSZW1v dmVkIG1ldGhvZCBzZXRYU1NBdWRpdG9yRW5hYmxlZCwgYW5kIGZpZWxkIG1faXNFbmFibGVkLiBN b3ZlZCBpbXBsZW1lbnRhdGlvbiBvZiBpc0VuYWJsZWQgdG8gWFNTQXVkaXRvci5jcHAgYW5kIGNo YW5nZWQgaW1wbGVtZW50YXRpb24gdG8gcXVlcnkgU2V0dGluZ3MuCisKIDIwMDktMDYtMTkgIEFs aWNlIExpdSAgPGFsaWNlLmxpdUBhcHBsZS5jb20+CiAKICAgICAgICAgRml4IGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yNjU2OCAKSW5kZXg6IFdlYkNvcmUvcGFnZS9Y U1NBdWRpdG9yLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL3BhZ2UvWFNTQXVkaXRvci5jcHAJ KHJldmlzaW9uIDQ0OTAwKQorKysgV2ViQ29yZS9wYWdlL1hTU0F1ZGl0b3IuY3BwCSh3b3JraW5n IGNvcHkpCkBAIC00NywyMSArNDcsMjMgQEAgc3RhdGljIGJvb2wgaXNDb250cm9sQ2hhcmFjdGVy KFVDaGFyIGMpCiAgICByZXR1cm4gYyA8ICcgJyB8fCBjID09IDEyNzsKIH0KICAgCi1YU1NBdWRp dG9yOjpYU1NBdWRpdG9yKEZyYW1lKiBmcmFtZSkKLSAgICA6IG1faXNFbmFibGVkKGZhbHNlKQot ICAgICwgbV9mcmFtZShmcmFtZSkKK1hTU0F1ZGl0b3I6OlhTU0F1ZGl0b3IoRnJhbWUqIGZyYW1l KSA6IG1fZnJhbWUoZnJhbWUpCiB7Ci0gICAgaWYgKFNldHRpbmdzKiBzZXR0aW5ncyA9IGZyYW1l LT5zZXR0aW5ncygpKQotICAgICAgICBtX2lzRW5hYmxlZCA9IHNldHRpbmdzLT54c3NBdWRpdG9y RW5hYmxlZCgpOwogfQogCiBYU1NBdWRpdG9yOjp+WFNTQXVkaXRvcigpCiB7CiB9CisgICAgCiti b29sIFhTU0F1ZGl0b3I6OmlzRW5hYmxlZCgpIGNvbnN0Cit7CisgICAgU2V0dGluZ3MqIHNldHRp bmdzID0gbV9mcmFtZS0+c2V0dGluZ3MoKTsKKyAgICByZXR1cm4gKHNldHRpbmdzICYmIHNldHRp bmdzLT54c3NBdWRpdG9yRW5hYmxlZCgpKTsKK30KICAgCiBib29sIFhTU0F1ZGl0b3I6OmNhbkV2 YWx1YXRlKGNvbnN0IFN0cmluZyYgc291cmNlQ29kZSkgY29uc3QKIHsKLSAgICBpZiAoIW1faXNF bmFibGVkKQorICAgIGlmICghaXNFbmFibGVkKCkpCiAgICAgICAgIHJldHVybiB0cnVlOwogICAg IAogICAgIGlmIChmaW5kSW5SZXF1ZXN0KHNvdXJjZUNvZGUpKSB7CkBAIC03NCw3ICs3Niw3IEBA IGJvb2wgWFNTQXVkaXRvcjo6Y2FuRXZhbHVhdGUoY29uc3QgU3RyaW4KIAogYm9vbCBYU1NBdWRp dG9yOjpjYW5DcmVhdGVJbmxpbmVFdmVudExpc3RlbmVyKGNvbnN0IFN0cmluZyYsIGNvbnN0IFN0 cmluZyYgY29kZSkgY29uc3QKIHsKLSAgICBpZiAoIW1faXNFbmFibGVkKQorICAgIGlmICghaXNF bmFibGVkKCkpCiAgICAgICAgIHJldHVybiB0cnVlOwogICAgIAogICAgIHJldHVybiBjYW5FdmFs dWF0ZShjb2RlKTsKQEAgLTgyLDcgKzg0LDcgQEAgYm9vbCBYU1NBdWRpdG9yOjpjYW5DcmVhdGVJ bmxpbmVFdmVudExpcwogCiBib29sIFhTU0F1ZGl0b3I6OmNhbkxvYWRFeHRlcm5hbFNjcmlwdEZy b21TcmMoY29uc3QgU3RyaW5nJiB1cmwpIGNvbnN0CiB7Ci0gICAgaWYgKCFtX2lzRW5hYmxlZCkK KyAgICBpZiAoIWlzRW5hYmxlZCgpKQogICAgICAgICByZXR1cm4gdHJ1ZTsKICAgCiAgICAgaWYg KGZpbmRJblJlcXVlc3QodXJsKSkgewpAQCAtOTUsNyArOTcsNyBAQCBib29sIFhTU0F1ZGl0b3I6 OmNhbkxvYWRFeHRlcm5hbFNjcmlwdEZyCiAKIGJvb2wgWFNTQXVkaXRvcjo6Y2FuTG9hZE9iamVj dChjb25zdCBTdHJpbmcmIHVybCkgY29uc3QKIHsKLSAgICBpZiAoIW1faXNFbmFibGVkKQorICAg IGlmICghaXNFbmFibGVkKCkpCiAgICAgICAgIHJldHVybiB0cnVlOwogCiAgICAgaWYgKGZpbmRJ blJlcXVlc3QodXJsKSkgewpJbmRleDogV2ViQ29yZS9wYWdlL1hTU0F1ZGl0b3IuaAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBXZWJDb3JlL3BhZ2UvWFNTQXVkaXRvci5oCShyZXZpc2lvbiA0NDkwMCkKKysrIFdl YkNvcmUvcGFnZS9YU1NBdWRpdG9yLmgJKHdvcmtpbmcgY29weSkKQEAgLTI3LDcgKzI3LDYgQEAK ICNpZm5kZWYgWFNTQXVkaXRvcl9oCiAjZGVmaW5lIFhTU0F1ZGl0b3JfaAogCi0jaW5jbHVkZSAi Y29uZmlnLmgiCiAjaW5jbHVkZSAiUGxhdGZvcm1TdHJpbmcuaCIKICNpbmNsdWRlICJUZXh0RW5j b2RpbmcuaCIKIApAQCAtNjksOCArNjgsNyBAQCBuYW1lc3BhY2UgV2ViQ29yZSB7CiAgICAgICAg IFhTU0F1ZGl0b3IoRnJhbWUqKTsKICAgICAgICAgflhTU0F1ZGl0b3IoKTsKIAotICAgICAgICBi b29sIGlzRW5hYmxlZCgpIGNvbnN0IHsgcmV0dXJuIG1faXNFbmFibGVkOyB9Ci0gICAgICAgIHZv aWQgc2V0WFNTQXVkaXRvckVuYWJsZWQoYm9vbCBlbmFibGVkKSB7IG1faXNFbmFibGVkID0gZW5h YmxlZDsgfQorICAgICAgICBib29sIGlzRW5hYmxlZCgpIGNvbnN0OwogCiAgICAgICAgIC8vIERl dGVybWluZXMgd2hldGhlciB0aGUgc2NyaXB0IHNob3VsZCBiZSBhbGxvd2VkIG9yIGRlbmllZCBl eGVjdXRpb24KICAgICAgICAgLy8gYmFzZWQgb24gdGhlIGNvbnRlbnQgb2YgYW55IHVzZXItc3Vi bWl0dGVkIGRhdGEuCkBAIC05NSw5ICs5Myw2IEBAIG5hbWVzcGFjZSBXZWJDb3JlIHsKIAogICAg ICAgICBib29sIGZpbmRJblJlcXVlc3QoY29uc3QgU3RyaW5nJikgY29uc3Q7CiAKLSAgICAgICAg Ly8gV2hldGhlciB0byBhdWRpdCBzY3JpcHRzLgotICAgICAgICBib29sIG1faXNFbmFibGVkOwot CiAgICAgICAgIC8vIFRoZSBmcmFtZSB0byBhdWRpdC4KICAgICAgICAgRnJhbWUqIG1fZnJhbWU7 CiAgICAgfTsKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlv dXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDQ0OTEwKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMDktMDYtMjEgIERhbmllbCBC YXRlcyAgPGRiYXRlc0BpbnR1ZGF0YS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisgICAgICAgIAorICAgICAgICBUZXN0IGZvciBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjY1ODAKKyAgICAgICAgCisgICAgICAgIFRlc3RzIHRoYXQg WFNTQXVkaXRvciAoaWYgZW5hYmxlZCkgcHJldmVudHMgc2NyaXB0IGV4ZWN1dGlvbiBpbiBjaGls ZCB3aW5kb3cuCisKKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3IvbGlu ay1vcGVucy1uZXctd2luZG93LWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogaHR0cC90 ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL2xpbmstb3BlbnMtbmV3LXdpbmRvdy5odG1sOiBBZGRl ZC4KKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3IvcmVzb3VyY2VzL2Vj aG8taW50ZXJ0YWctYW5kLW5vdGlmeS5waHA6IEFkZGVkLgorCiAyMDA5LTA2LTIwICBEYXJpbiBB ZGxlciAgPGRhcmluQGFwcGxlLmNvbT4KIAogICAgICAgICAqIHBsYXRmb3JtL2d0ay9Ta2lwcGVk OiBTa2lwIHNvbWUgbmV3IHRlc3RzLgpJbmRleDogTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1 cml0eS94c3NBdWRpdG9yL2xpbmstb3BlbnMtbmV3LXdpbmRvdy1leHBlY3RlZC50eHQKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL2xpbmst b3BlbnMtbmV3LXdpbmRvdy1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0 cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3IvbGluay1vcGVucy1uZXctd2luZG93LWV4 cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwzIEBACitDT05TT0xFIE1FU1NBR0U6 IGxpbmUgMTogUmVmdXNlZCB0byBleGVjdXRlIGEgSmF2YVNjcmlwdCBzY3JpcHQuIFNvdXJjZSBj b2RlIG9mIHNjcmlwdCBmb3VuZCB3aXRoaW4gcmVxdWVzdC4KKworQ2xpY2sgbWUKSW5kZXg6IExh eW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9saW5rLW9wZW5zLW5ldy13 aW5kb3cuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5 L3hzc0F1ZGl0b3IvbGluay1vcGVucy1uZXctd2luZG93Lmh0bWwJKHJldmlzaW9uIDApCisrKyBM YXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3IvbGluay1vcGVucy1uZXct d2luZG93Lmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMjQgQEAKKzwhRE9DVFlQRSBodG1s PgorPGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9s bGVyKSB7CisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuc2V0WFNTQXVkaXRvckVuYWJsZWQodHJ1 ZSk7CisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworICAgIGxheW91dFRl c3RDb250cm9sbGVyLmR1bXBDaGlsZEZyYW1lc0FzVGV4dCgpOworICAgIGxheW91dFRlc3RDb250 cm9sbGVyLndhaXRVbnRpbERvbmUoKTsKKyAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5zZXRDYW5P cGVuV2luZG93cygpOworICAgIGxheW91dFRlc3RDb250cm9sbGVyLnNldENsb3NlUmVtYWluaW5n V2luZG93c1doZW5Db21wbGV0ZSh0cnVlKTsKK30KK3dpbmRvdy5vbmxvYWQgPSBmdW5jdGlvbigp Cit7CisgICAgdmFyIGV2ZW50ID0gZG9jdW1lbnQuY3JlYXRlRXZlbnQoJ01vdXNlRXZlbnQnKTsK KyAgICBldmVudC5pbml0RXZlbnQoJ2NsaWNrJywgdHJ1ZSwgdHJ1ZSk7CisgICAgZG9jdW1lbnQu Z2V0RWxlbWVudEJ5SWQoJ2FuY2hvckxpbmsnKS5kaXNwYXRjaEV2ZW50KGV2ZW50KTsKK30KKzwv c2NyaXB0PgorPC9oZWFkPgorPGJvZHk+Cis8YSBpZD0iYW5jaG9yTGluayIgaHJlZj0iaHR0cDov L2xvY2FsaG9zdDo4MDAwL3NlY3VyaXR5L3hzc0F1ZGl0b3IvcmVzb3VyY2VzL2VjaG8taW50ZXJ0 YWctYW5kLW5vdGlmeS5waHA/cT08c2NyaXB0PmFsZXJ0KC9YU1MvKTwvc2NyaXB0PiIgdGFyZ2V0 PSJfYmxhbmsiPkNsaWNrIG1lPC9hPgorPC9ib2R5PgorPC9odG1sPgpJbmRleDogTGF5b3V0VGVz dHMvaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL3Jlc291cmNlcy9lY2hvLWludGVydGFn LWFuZC1ub3RpZnkucGhwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2Vj dXJpdHkveHNzQXVkaXRvci9yZXNvdXJjZXMvZWNoby1pbnRlcnRhZy1hbmQtbm90aWZ5LnBocAko cmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRv ci9yZXNvdXJjZXMvZWNoby1pbnRlcnRhZy1hbmQtbm90aWZ5LnBocAkocmV2aXNpb24gMCkKQEAg LTAsMCArMSwxMyBAQAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxib2R5PgorPD9waHAKK2Vj aG8gJF9HRVRbJ3EnXTsKKz8+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJv bGxlcikgeworICBsYXlvdXRUZXN0Q29udHJvbGxlci5ub3RpZnlEb25lKCk7Cit9Cis8L3Njcmlw dD4KKzwvYm9keT4KKzwvaHRtbD4K