39560 2010-05-22 23:00:50 -0700 REGRESSION: xssAuditor tests failing in Chromium 2010-05-23 00:49:20 -0700 1 1 1 Unclassified WebKit Page Loading 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED XSSAuditor P2 Normal --- 1 jparent jparent abarth dbates eric webkit.review.bot oldest_to_newest 229402 0 jparent 2010-05-22 23:00:50 -0700 A bunch of xssAuditor tests are failing in Chromium (all platforms) after http://trac.webkit.org/changeset/60014/. Failing tests: http/tests/security/xssAuditor/anchor-url-dom-write-location.html,http/tests/security/xssAuditor/dom-write-URL.html,http/tests/security/xssAuditor/dom-write-location.html,http/tests/security/xssAuditor/full-block-get-from-iframe.html,http/tests/security/xssAuditor/full-block-iframe-no-inherit.php,http/tests/security/xssAuditor/full-block-post-from-iframe.html,http/tests/security/xssAuditor/get-from-iframe.html,http/tests/security/xssAuditor/javascript-link-safe.html,http/tests/security/xssAuditor/link-opens-new-window.html,http/tests/security/xssAuditor/malformed-xss-protection-header.html,http/tests/security/xssAuditor/post-from-iframe.html,http/tests/security/xssAuditor/script-tag-addslashes-backslash.html,http/tests/security/xssAuditor/script-tag-addslashes-double-quote.html,http/tests/security/xssAuditor/script-tag-addslashes-null-char.html,http/tests/security/xssAuditor/script-tag-addslashes-single-quote.html,http/tests/security/xssAuditor/script-tag-control-char.html,http/tests/security/xssAuditor/script-tag-convoluted.html,http/tests/security/xssAuditor/script-tag-entities.html,http/tests/security/xssAuditor/script-tag-null-char.html,http/tests/security/xssAuditor/script-tag-open-redirect.html,http/tests/security/xssAuditor/script-tag-post-control-char.html,http/tests/security/xssAuditor/script-tag-post-null-char.html,http/tests/security/xssAuditor/script-tag-post.html,http/tests/security/xssAuditor/script-tag-redirect.html,http/tests/security/xssAuditor/script-tag.html,http/tests/security/xssAuditor/xss-protection-parsing-01.html,http/tests/security/xssAuditor/full-block-script-tag.html They all fail with ALERT: /XSS/. I think the issue is just a bad if statement in trunk/WebCore/bindings/v8/ScriptController.cpp, patch upcoming. 229404 1 56809 jparent 2010-05-22 23:07:16 -0700 Created attachment 56809 Patch - Just making the v8 if statement match jsc one. Running this change with Chromium makes the failing tests pass, but granted, I don't know anything about this code, so please make sure this makes sense! 229406 2 56809 abarth 2010-05-22 23:10:20 -0700 Comment on attachment 56809 Patch - Just making the v8 if statement match jsc one. LGTM. I must have missed that in the review, thanks. 229408 3 jparent 2010-05-22 23:46:30 -0700 Committed in http://trac.webkit.org/changeset/60028. 229417 4 webkit.review.bot 2010-05-23 00:22:19 -0700 http://trac.webkit.org/changeset/60028 might have broken SnowLeopard Intel Release (Tests) 229420 5 dbates 2010-05-23 00:49:20 -0700 I take responsibility. I first made shouldAllowXSS a boolean then switched to an enum for clarity and missed changing the V8 code. Thanks Julie Parent and Adam Barth for following up. 56809 2010-05-22 23:07:16 -0700 2010-05-22 23:10:20 -0700 Patch - Just making the v8 if statement match jsc one. xss.txt text/plain 1312 jparent SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA2MDAyNykKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTUgQEAKKzIwMTAtMDUtMjIgIEp1bGllIFBhcmVudCAgPGpwYXJlbnRAY2hyb21p dW0ub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IFJFR1JFU1NJT046IHhzc0F1ZGl0b3IgdGVzdHMgZmFpbGluZyBpbiBDaHJvbWl1bS4KKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM5NTYwCisKKyAgICAg ICAgRm9sbG93IHVwIHRvIHIwMDE0LiBNYWtlIGlmIHN0YXRlbWVudCBpbiBWOCBiaW5kaW5ncyBt YXRjaCB0aGUgb25lIGZyb20ganNjIHZlcnNpb24uCisKKyAgICAgICAgKiBiaW5kaW5ncy92OC9T Y3JpcHRDb250cm9sbGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlNjcmlwdENvbnRyb2xsZXI6 OmV2YWx1YXRlKToKKwogMjAxMC0wNS0yMiAgTWFjaWVqIFN0YWNob3dpYWsgIDxtanNAYXBwbGUu Y29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IE1hcmsgUm93ZS4KSW5kZXg6IFdlYkNvcmUvYmlu ZGluZ3MvdjgvU2NyaXB0Q29udHJvbGxlci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9iaW5k aW5ncy92OC9TY3JpcHRDb250cm9sbGVyLmNwcAkocmV2aXNpb24gNjAwMjcpCisrKyBXZWJDb3Jl L2JpbmRpbmdzL3Y4L1NjcmlwdENvbnRyb2xsZXIuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yMzAs NyArMjMwLDcgQEAgU2NyaXB0VmFsdWUgU2NyaXB0Q29udHJvbGxlcjo6ZXZhbHVhdGUoYwogICAg IGNvbnN0IFN0cmluZyogc2F2ZWRTb3VyY2VVUkwgPSBtX3NvdXJjZVVSTDsKICAgICBtX3NvdXJj ZVVSTCA9ICZzb3VyY2VVUkw7CiAKLSAgICBpZiAoIXNob3VsZEFsbG93WFNTICYmICFtX1hTU0F1 ZGl0b3ItPmNhbkV2YWx1YXRlKHNvdXJjZUNvZGUuc291cmNlKCkpKSB7CisgICAgaWYgKHNob3Vs ZEFsbG93WFNTID09IERvTm90QWxsb3dYU1MgJiYgIW1fWFNTQXVkaXRvci0+Y2FuRXZhbHVhdGUo c291cmNlQ29kZS5zb3VyY2UoKSkpIHsKICAgICAgICAgLy8gVGhpcyBzY3JpcHQgaXMgbm90IHNh ZmUgdG8gYmUgZXZhbHVhdGVkLgogICAgICAgICByZXR1cm4gU2NyaXB0VmFsdWUoKTsKICAgICB9 Cg==