45377 2010-09-08 03:35:28 -0700 Errors in LayoutTests/http/tests/security/xss-DENIED-mime-type-execute-as-html.html 2010-09-08 09:30:49 -0700 1 1 1 Unclassified WebKit Tools / Tests 528+ (Nightly build) PC All RESOLVED FIXED P2 Normal --- 37540 0 svillar webkit-unassigned abarth commit-queue eric webkit.review.bot oldest_to_newest 275717 0 svillar 2010-09-08 03:35:28 -0700 There are several errors in LayoutTests/http/tests/security/xss-DENIED-mime-type-execute-as-html.html * in the .html encodeURIComponent should be used instead of escape (because the URIs contain '+') http://www.w3schools.com/jsref/jsref_encodeURIComponent.asp * in the PHP urldecode cannot be used with $_GET as it's already decoded http://php.net/manual/en/function.urldecode.php 275721 1 66866 svillar 2010-09-08 03:38:47 -0700 Created attachment 66866 Fix for the bug 275722 2 svillar 2010-09-08 03:39:55 -0700 Adding Adam to Cc: as bug was discussed with him on IRC 275724 3 66866 abarth 2010-09-08 03:46:05 -0700 Comment on attachment 66866 Fix for the bug View in context: https://bugs.webkit.org/attachment.cgi?id=66866&action=prettypatch Please add more detail to the ChangeLog before landing. > LayoutTests/ChangeLog:7 > + Errors in LayoutTests/http/tests/security/xss-DENIED-mime-type-execute-as-html.html > + https://bugs.webkit.org/show_bug.cgi?id=45377 > + It would be better if your ChangeLog explains what problem this patch solves. "Errors" is a pretty general problem. You explained it to me over IRC, but someone reading this ChangeLog will be pretty mystified. > LayoutTests/http/tests/security/resources/send-mime-types.php:2 > - $mime_type = urldecode($_GET["mt"]); > + $mime_type = $_GET["mt"]; Yeah, the old code is pretty confused, huh? > LayoutTests/http/tests/security/xss-DENIED-mime-type-execute-as-html.html:19 > - ifr.src = "http://localhost:8000/security/resources/send-mime-types.php?mt=" + escape(mime_types[i]); > + ifr.src = "http://localhost:8000/security/resources/send-mime-types.php?mt=" + encodeURIComponent(mime_types[i]); Did this change actually make a difference? It seems like the other change is probably the operative one. 275729 4 svillar 2010-09-08 03:50:45 -0700 (In reply to comment #3) > (From update of attachment 66866 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=66866&action=prettypatch > > Please add more detail to the ChangeLog before landing. > > > LayoutTests/ChangeLog:7 > > + Errors in LayoutTests/http/tests/security/xss-DENIED-mime-type-execute-as-html.html > > + https://bugs.webkit.org/show_bug.cgi?id=45377 > > + > It would be better if your ChangeLog explains what problem this patch solves. "Errors" is a pretty general problem. You explained it to me over IRC, but someone reading this ChangeLog will be pretty mystified. Ok I agree. will add more detail > > > LayoutTests/http/tests/security/resources/send-mime-types.php:2 > > - $mime_type = urldecode($_GET["mt"]); > > + $mime_type = $_GET["mt"]; > Yeah, the old code is pretty confused, huh? Yep :-) > > LayoutTests/http/tests/security/xss-DENIED-mime-type-execute-as-html.html:19 > > - ifr.src = "http://localhost:8000/security/resources/send-mime-types.php?mt=" + escape(mime_types[i]); > > + ifr.src = "http://localhost:8000/security/resources/send-mime-types.php?mt=" + encodeURIComponent(mime_types[i]); > Did this change actually make a difference? It seems like the other change is probably the operative one. Yes it's also a must. Without it the PHP will get a '+' character anyway and then transform it into a blank space when parsing the URL. 275738 5 66872 svillar 2010-09-08 04:05:18 -0700 Created attachment 66872 Fix the URL encoding/decoding mess in the bug With a more descriptive ChangeLog entry 275848 6 66872 commit-queue 2010-09-08 08:19:00 -0700 Comment on attachment 66872 Fix the URL encoding/decoding mess in the bug Clearing flags on attachment: 66872 Committed r66985: <http://trac.webkit.org/changeset/66985> 275849 7 commit-queue 2010-09-08 08:19:04 -0700 All reviewed patches have been landed. Closing bug. 275877 8 webkit.review.bot 2010-09-08 09:30:49 -0700 http://trac.webkit.org/changeset/66985 might have broken GTK Linux 64-bit Debug The following changes are on the blame list: http://trac.webkit.org/changeset/66985 http://trac.webkit.org/changeset/66986 66866 2010-09-08 03:38:47 -0700 2010-09-08 04:05:18 -0700 Fix for the bug 0001-Fix-for-45377.patch text/plain 2367 svillar RnJvbSAyYjA5YjMwMmZkYTk3NTI2ZjgyZjJmNDZkYjNkMmVjZWU5YjQxMDQwIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBTZXJnaW8gVmlsbGFyIFNlbmluIDxzdmlsbGFyQGlnYWxpYS5j b20+CkRhdGU6IFdlZCwgOCBTZXAgMjAxMCAxMjozNjo1OSArMDIwMApTdWJqZWN0OiBbUEFUQ0hd IEZpeCBmb3IgNDUzNzcKCi0tLQogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgfCAgIDEwICsrKysrKysrKysKIC4uLi90ZXN0cy9zZWN1cml0eS9yZXNv dXJjZXMvc2VuZC1taW1lLXR5cGVzLnBocCAgIHwgICAgMiArLQogLi4uL3hzcy1ERU5JRUQtbWlt ZS10eXBlLWV4ZWN1dGUtYXMtaHRtbC5odG1sICAgICAgfCAgICAyICstCiAzIGZpbGVzIGNoYW5n ZWQsIDEyIGluc2VydGlvbnMoKyksIDIgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvTGF5b3V0 VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGQ5MTVjOWUuLjFj NDE1NzQgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0 cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAxMC0wOS0wOCAgU2VyZ2lvIFZpbGxhciBT ZW5pbiAgPHN2aWxsYXJAaWdhbGlhLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICBFcnJvcnMgaW4gTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1 cml0eS94c3MtREVOSUVELW1pbWUtdHlwZS1leGVjdXRlLWFzLWh0bWwuaHRtbAorICAgICAgICBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NDUzNzcKKworICAgICAgICAq IGh0dHAvdGVzdHMvc2VjdXJpdHkvcmVzb3VyY2VzL3NlbmQtbWltZS10eXBlcy5waHA6CisgICAg ICAgICogaHR0cC90ZXN0cy9zZWN1cml0eS94c3MtREVOSUVELW1pbWUtdHlwZS1leGVjdXRlLWFz LWh0bWwuaHRtbDoKKwogMjAxMC0wOS0wNiAgQWRhbSBCYXJ0aCAgPGFiYXJ0aEB3ZWJraXQub3Jn PgogCiAgICAgICAgIFVwZGF0ZSBleHBlY3RlZCByZXN1bHRzIHRvIG1hdGNoIGNoYW5nZSBpbiB0 ZXN0LiAgUXQncyBiZWhhdmlvciBpcwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvaHR0cC90ZXN0 cy9zZWN1cml0eS9yZXNvdXJjZXMvc2VuZC1taW1lLXR5cGVzLnBocCBiL0xheW91dFRlc3RzL2h0 dHAvdGVzdHMvc2VjdXJpdHkvcmVzb3VyY2VzL3NlbmQtbWltZS10eXBlcy5waHAKaW5kZXggNDI1 MGVkYS4uNTBhMWQyOCAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0 eS9yZXNvdXJjZXMvc2VuZC1taW1lLXR5cGVzLnBocAorKysgYi9MYXlvdXRUZXN0cy9odHRwL3Rl c3RzL3NlY3VyaXR5L3Jlc291cmNlcy9zZW5kLW1pbWUtdHlwZXMucGhwCkBAIC0xLDUgKzEsNSBA QAogPD9waHAKLSAgICAkbWltZV90eXBlID0gdXJsZGVjb2RlKCRfR0VUWyJtdCJdKTsKKyAgICAk bWltZV90eXBlID0gJF9HRVRbIm10Il07CiAgICAgCiAgICAgaGVhZGVyKCJDb250ZW50LVR5cGU6 ICIuJG1pbWVfdHlwZSk7CiAKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2Vj dXJpdHkveHNzLURFTklFRC1taW1lLXR5cGUtZXhlY3V0ZS1hcy1odG1sLmh0bWwgYi9MYXlvdXRU ZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzcy1ERU5JRUQtbWltZS10eXBlLWV4ZWN1dGUtYXMt aHRtbC5odG1sCmluZGV4IDU2OTllNDQuLjRjYjU4MzYgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3Rz L2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzLURFTklFRC1taW1lLXR5cGUtZXhlY3V0ZS1hcy1odG1s Lmh0bWwKKysrIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS94c3MtREVOSUVELW1p bWUtdHlwZS1leGVjdXRlLWFzLWh0bWwuaHRtbApAQCAtMTYsNyArMTYsNyBAQCB2YXIgbWltZV90 eXBlcyA9IFsiYXBwbGljYXRpb24vYXRvbSt4bWwiLCAiYXBwbGljYXRpb24vanNvbiIsCiAgICAg ICAgICAgICAgICAgICAKIGZvcih2YXIgaSBpbiBtaW1lX3R5cGVzKSB7CiAgIHZhciBpZnIgPSBk b2N1bWVudC5jcmVhdGVFbGVtZW50KCdpZnJhbWUnKTsKLSAgaWZyLnNyYyA9ICJodHRwOi8vbG9j YWxob3N0OjgwMDAvc2VjdXJpdHkvcmVzb3VyY2VzL3NlbmQtbWltZS10eXBlcy5waHA/bXQ9IiAr IGVzY2FwZShtaW1lX3R5cGVzW2ldKTsKKyAgaWZyLnNyYyA9ICJodHRwOi8vbG9jYWxob3N0Ojgw MDAvc2VjdXJpdHkvcmVzb3VyY2VzL3NlbmQtbWltZS10eXBlcy5waHA/bXQ9IiArIGVuY29kZVVS SUNvbXBvbmVudChtaW1lX3R5cGVzW2ldKTsKICAgZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChp ZnIpOwogfQogPC9zY3JpcHQ+Ci0tIAoxLjcuMQoK 66872 2010-09-08 04:05:18 -0700 2010-09-08 08:19:00 -0700 Fix the URL encoding/decoding mess in the bug 0001-Fix-for-45377.patch text/plain 2714 svillar RnJvbSA4MjgwOGE3ZTI2YTQ1MDg0NDdmMDM2MDQzODMxMDM3N2FiYTY5YmUyIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBTZXJnaW8gVmlsbGFyIFNlbmluIDxzdmlsbGFyQGlnYWxpYS5j b20+CkRhdGU6IFdlZCwgOCBTZXAgMjAxMCAxMjozNjo1OSArMDIwMApTdWJqZWN0OiBbUEFUQ0hd IEZpeCBmb3IgNDUzNzcKCi0tLQogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgfCAgIDE2ICsrKysrKysrKysrKysrKysKIC4uLi90ZXN0cy9zZWN1cml0 eS9yZXNvdXJjZXMvc2VuZC1taW1lLXR5cGVzLnBocCAgIHwgICAgMiArLQogLi4uL3hzcy1ERU5J RUQtbWltZS10eXBlLWV4ZWN1dGUtYXMtaHRtbC5odG1sICAgICAgfCAgICAyICstCiAzIGZpbGVz IGNoYW5nZWQsIDE4IGluc2VydGlvbnMoKyksIDIgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEv TGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGQ5MTVj OWUuLjI5NGU4MzkgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlv dXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxOSBAQAorMjAxMC0wOS0wOCAgU2VyZ2lvIFZp bGxhciBTZW5pbiAgPHN2aWxsYXJAaWdhbGlhLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBFcnJvcnMgaW4gTGF5b3V0VGVzdHMvaHR0cC90ZXN0 cy9zZWN1cml0eS94c3MtREVOSUVELW1pbWUtdHlwZS1leGVjdXRlLWFzLWh0bWwuaHRtbAorICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NDUzNzcKKworICAg ICAgICBUaGUgdGVzdCBwYXNzZXMgYSBNSU1FIHR5cGUgYXMgYXJndW1lbnQgb2YgYSBVUkwuIEEg UEhQIGNvZGUgdXNlcworICAgICAgICB0aGF0IE1JTUUgdHlwZSB0byBmaWxsIHRoZSBDb250ZW50 LVR5cGUgb2YgdGhlIHJlc3BvbnNlLiAgSWYgdGhlCisgICAgICAgIE1JTUUgdHlwZSBpcyBhcHBs aWNhdGlvbi9yc3MreG1sIHRoZSBwaHAgZGVjb2RlcyB0aGUgJysnIGFzIGEKKyAgICAgICAgYmxh bmsgc3BhY2UgYW5kIHRodXMgdGhlIHJldHVybmVkIGNvbnRlbnQgdHlwZSBpcyBpbmNvcnJlY3Rs eSBzZXQKKyAgICAgICAgdG8gInJzcyB4bWwiIGluc3RlYWQgb2YgInJzcyt4bWwiLgorCisgICAg ICAgICogaHR0cC90ZXN0cy9zZWN1cml0eS9yZXNvdXJjZXMvc2VuZC1taW1lLXR5cGVzLnBocDoK KyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L3hzcy1ERU5JRUQtbWltZS10eXBlLWV4ZWN1 dGUtYXMtaHRtbC5odG1sOgorCiAyMDEwLTA5LTA2ICBBZGFtIEJhcnRoICA8YWJhcnRoQHdlYmtp dC5vcmc+CiAKICAgICAgICAgVXBkYXRlIGV4cGVjdGVkIHJlc3VsdHMgdG8gbWF0Y2ggY2hhbmdl IGluIHRlc3QuICBRdCdzIGJlaGF2aW9yIGlzCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9odHRw L3Rlc3RzL3NlY3VyaXR5L3Jlc291cmNlcy9zZW5kLW1pbWUtdHlwZXMucGhwIGIvTGF5b3V0VGVz dHMvaHR0cC90ZXN0cy9zZWN1cml0eS9yZXNvdXJjZXMvc2VuZC1taW1lLXR5cGVzLnBocAppbmRl eCA0MjUwZWRhLi41MGExZDI4IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3Nl Y3VyaXR5L3Jlc291cmNlcy9zZW5kLW1pbWUtdHlwZXMucGhwCisrKyBiL0xheW91dFRlc3RzL2h0 dHAvdGVzdHMvc2VjdXJpdHkvcmVzb3VyY2VzL3NlbmQtbWltZS10eXBlcy5waHAKQEAgLTEsNSAr MSw1IEBACiA8P3BocAotICAgICRtaW1lX3R5cGUgPSB1cmxkZWNvZGUoJF9HRVRbIm10Il0pOwor ICAgICRtaW1lX3R5cGUgPSAkX0dFVFsibXQiXTsKICAgICAKICAgICBoZWFkZXIoIkNvbnRlbnQt VHlwZTogIi4kbWltZV90eXBlKTsKIApkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvaHR0cC90ZXN0 cy9zZWN1cml0eS94c3MtREVOSUVELW1pbWUtdHlwZS1leGVjdXRlLWFzLWh0bWwuaHRtbCBiL0xh eW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzLURFTklFRC1taW1lLXR5cGUtZXhlY3V0 ZS1hcy1odG1sLmh0bWwKaW5kZXggNTY5OWU0NC4uNGNiNTgzNiAxMDA2NDQKLS0tIGEvTGF5b3V0 VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS94c3MtREVOSUVELW1pbWUtdHlwZS1leGVjdXRlLWFz LWh0bWwuaHRtbAorKysgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzcy1ERU5J RUQtbWltZS10eXBlLWV4ZWN1dGUtYXMtaHRtbC5odG1sCkBAIC0xNiw3ICsxNiw3IEBAIHZhciBt aW1lX3R5cGVzID0gWyJhcHBsaWNhdGlvbi9hdG9tK3htbCIsICJhcHBsaWNhdGlvbi9qc29uIiwK ICAgICAgICAgICAgICAgICAgIAogZm9yKHZhciBpIGluIG1pbWVfdHlwZXMpIHsKICAgdmFyIGlm ciA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2lmcmFtZScpOwotICBpZnIuc3JjID0gImh0dHA6 Ly9sb2NhbGhvc3Q6ODAwMC9zZWN1cml0eS9yZXNvdXJjZXMvc2VuZC1taW1lLXR5cGVzLnBocD9t dD0iICsgZXNjYXBlKG1pbWVfdHlwZXNbaV0pOworICBpZnIuc3JjID0gImh0dHA6Ly9sb2NhbGhv c3Q6ODAwMC9zZWN1cml0eS9yZXNvdXJjZXMvc2VuZC1taW1lLXR5cGVzLnBocD9tdD0iICsgZW5j b2RlVVJJQ29tcG9uZW50KG1pbWVfdHlwZXNbaV0pOwogICBkb2N1bWVudC5ib2R5LmFwcGVuZENo aWxkKGlmcik7CiB9CiA8L3NjcmlwdD4KLS0gCjEuNy4xCgo=