<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>30418</bug_id>
          
          <creation_ts>2009-10-15 17:35:17 -0700</creation_ts>
          <short_desc>[XSSAuditor] http://www.apple.com/startpage fails to render properly</short_desc>
          <delta_ts>2009-10-15 23:40:33 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebCore Misc.</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://www.apple.com/startpage</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>XSSAuditor</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Daniel Bates">dbates</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>abarth</cc>
    
    <cc>sam</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>154958</commentid>
    <comment_count>0</comment_count>
    <who name="Daniel Bates">dbates</who>
    <bug_when>2009-10-15 17:35:17 -0700</bug_when>
    <thetext>The Apple start page fails to render properly because the XSSAuditor blocks loading content with respect to the specified HTML Base element. Notice the first seven characters of the src property of the HTML Base element is &quot;http://&quot; which is clearly in the page URL.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>154959</commentid>
    <comment_count>1</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2009-10-15 17:45:48 -0700</bug_when>
    <thetext>Frown.  Let&apos;s revert the 7 character change while we think about these cases.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>154960</commentid>
    <comment_count>2</comment_count>
    <who name="Daniel Bates">dbates</who>
    <bug_when>2009-10-15 17:54:45 -0700</bug_when>
    <thetext>This issue also effects XSSAuditor::canLoadObject, and XSSAuditor::canEvaluateJavaScriptURL.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>155033</commentid>
    <comment_count>3</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2009-10-15 23:40:33 -0700</bug_when>
    <thetext>Dan rolled out the offending patch.</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>