53652 2011-02-02 17:42:26 -0800 Teach XSSFilter that <param> elements can contain URLs 2011-02-02 21:46:04 -0800 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Other OS X 10.5 RESOLVED FIXED P2 Normal --- 49845 1 abarth abarth commit-queue dbates eric sam oldest_to_newest 344451 0 abarth 2011-02-02 17:42:26 -0800 Teach XSSFilter that <param> elements can contain URLs 344452 1 81013 abarth 2011-02-02 17:45:06 -0800 Created attachment 81013 Patch 344453 2 abarth 2011-02-02 17:47:08 -0800 After this patch we pass all the xssAuditor tests! (Even the handful that the XSSAuditor fails.) 344518 3 81013 dbates 2011-02-02 21:08:04 -0800 Comment on attachment 81013 Patch LGTM 344519 4 dbates 2011-02-02 21:09:22 -0800 (In reply to comment #2) > After this patch we pass all the xssAuditor tests! (Even the handful that the XSSAuditor fails.) Yay! Go Adam go! 344526 5 81013 commit-queue 2011-02-02 21:46:00 -0800 Comment on attachment 81013 Patch Clearing flags on attachment: 81013 Committed r77467: <http://trac.webkit.org/changeset/77467> 344527 6 commit-queue 2011-02-02 21:46:04 -0800 All reviewed patches have been landed. Closing bug. 81013 2011-02-02 17:45:06 -0800 2011-02-02 21:46:00 -0800 Patch bug-53652-20110202174505.patch text/plain 6011 abarth ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCAwMTVmYTFmNTE3NTliNDM0NGZkYmJmMzVmYmJjYTYyYmFmN2FhYjU5Li42 NDU4NTY0YTA0MjVjY2E3YzRiYzBmMDQxZWE5YjZiOTZlMDFiN2NlIDEwMDY0NAotLS0gYS9Tb3Vy Y2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0y LDYgKzIsMzMgQEAKIAogICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KIAorICAg ICAgICBUZWFjaCBYU1NGaWx0ZXIgdGhhdCA8cGFyYW0+IGVsZW1lbnRzIGNhbiBjb250YWluIFVS THMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTUzNjUy CisKKyAgICAgICAgV2hlbiBsb2FkaW5nIHBsdWdpbnMgZm9yIHRoZSA8b2JqZWN0PiB0YWcsIHdl J3JlICJzbWFydCIgZW5vdWdoIHRvCisgICAgICAgIHJlYWNoIGludG8gdGhlIDxwYXJhbT4gZWxl bWVudHMgYW5kIHB1bGwgb3V0IHRoZSBVUkwgaW4gc29tZSBjYXNlcy4KKyAgICAgICAgVGhpcyBw YXRjaCB0ZWFjaGVzIHRoZSBYU1NGaWx0ZXIgaG93IHRvIGJsb2NrIGluamVjdGlvbnMgaW50byB0 aG9zZQorICAgICAgICBzb3J0cyBvZiBwYXJhbSBlbGVtZW50cy4KKworICAgICAgICBGaXhlczoK KyAgICAgICAgICAgIGh0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9vYmplY3QtKgorCisg ICAgICAgICogaHRtbC9IVE1MUGFyYW1FbGVtZW50LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkhU TUxQYXJhbUVsZW1lbnQ6OmlzVVJMUGFyYW1ldGVyKToKKyAgICAgICAgKFdlYkNvcmU6OkhUTUxQ YXJhbUVsZW1lbnQ6OmlzVVJMQXR0cmlidXRlKToKKyAgICAgICAgKFdlYkNvcmU6OkhUTUxQYXJh bUVsZW1lbnQ6OmFkZFN1YnJlc291cmNlQXR0cmlidXRlVVJMcyk6CisgICAgICAgICogaHRtbC9I VE1MUGFyYW1FbGVtZW50Lmg6CisgICAgICAgICAgICAtIEFkZCBhIGhlbHBlciBmdW5jdGlvbiBz byB0aGF0IEhUTUxQYXJhbUVsZW1lbnQgY2FuIHNoYXJlIHRoZQorICAgICAgICAgICAgICBncm91 bmQgdHJ1dGggZm9yIHRoZXNlIG5hbWVzIHdpdGggdGhlIFhTU0ZpbHRlci4KKyAgICAgICAgKiBo dG1sL3BhcnNlci9YU1NGaWx0ZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6WFNTRmlsdGVyOjpm aWx0ZXJUb2tlbkluaXRpYWwpOgorICAgICAgICAoV2ViQ29yZTo6WFNTRmlsdGVyOjpmaWx0ZXJQ YXJhbVRva2VuKToKKyAgICAgICAgKiBodG1sL3BhcnNlci9YU1NGaWx0ZXIuaDoKKworMjAxMS0w Mi0wMiAgQWRhbSBCYXJ0aCAgPGFiYXJ0aEB3ZWJraXQub3JnPgorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCiAgICAgICAgIFdoZW4gWFNTRmlsdGVyIGJsb2NrcyBKYXZh U2NyaXB0IFVSTHMsIHVzZSBhIHNhZmUgSmF2YVNjcmlwdCBVUkwKICAgICAgICAgaW5zdGVhZCBv ZiB0aGUgZW1wdHkgc3RyaW5nCiAgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD01MzY0MwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvaHRtbC9IVE1MUGFy YW1FbGVtZW50LmNwcCBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTFBhcmFtRWxlbWVudC5jcHAK aW5kZXggMmRjOWQxZDFiNzJlZWZkNWYwMzc2MGQzZGMxMjM4MGEyOTQ2OTZhZC4uNDVhNzRiMmZh NzA2OTFiMTNiMzA5N2EwYjA0N2RjZThlZGJlMjIyMiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNv cmUvaHRtbC9IVE1MUGFyYW1FbGVtZW50LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL0hU TUxQYXJhbUVsZW1lbnQuY3BwCkBAIC00Miw2ICs0MiwxMSBAQCBQYXNzUmVmUHRyPEhUTUxQYXJh bUVsZW1lbnQ+IEhUTUxQYXJhbUVsZW1lbnQ6OmNyZWF0ZShjb25zdCBRdWFsaWZpZWROYW1lJiB0 YWdOYQogICAgIHJldHVybiBhZG9wdFJlZihuZXcgSFRNTFBhcmFtRWxlbWVudCh0YWdOYW1lLCBk b2N1bWVudCkpOwogfQogCitib29sIEhUTUxQYXJhbUVsZW1lbnQ6OmlzVVJMUGFyYW1ldGVyKGNv bnN0IFN0cmluZyYgbmFtZSkKK3sKKyAgICByZXR1cm4gZXF1YWxJZ25vcmluZ0Nhc2UobmFtZSwg ImRhdGEiKSB8fCBlcXVhbElnbm9yaW5nQ2FzZShuYW1lLCAibW92aWUiKSB8fCBlcXVhbElnbm9y aW5nQ2FzZShuYW1lLCAic3JjIik7Cit9CisKIHZvaWQgSFRNTFBhcmFtRWxlbWVudDo6cGFyc2VN YXBwZWRBdHRyaWJ1dGUoQXR0cmlidXRlKiBhdHRyKQogewogICAgIGlmIChpc0lkQXR0cmlidXRl TmFtZShhdHRyLT5uYW1lKCkpKSB7CkBAIC02NCw3ICs2OSw3IEBAIGJvb2wgSFRNTFBhcmFtRWxl bWVudDo6aXNVUkxBdHRyaWJ1dGUoQXR0cmlidXRlKiBhdHRyKSBjb25zdAogICAgICAgICBBdHRy aWJ1dGUqIGF0dHIgPSBhdHRyaWJ1dGVzKCktPmdldEF0dHJpYnV0ZUl0ZW0obmFtZUF0dHIpOwog ICAgICAgICBpZiAoYXR0cikgewogICAgICAgICAgICAgY29uc3QgQXRvbWljU3RyaW5nJiB2YWx1 ZSA9IGF0dHItPnZhbHVlKCk7Ci0gICAgICAgICAgICBpZiAoZXF1YWxJZ25vcmluZ0Nhc2UodmFs dWUsICJkYXRhIikgfHwgZXF1YWxJZ25vcmluZ0Nhc2UodmFsdWUsICJtb3ZpZSIpIHx8IGVxdWFs SWdub3JpbmdDYXNlKHZhbHVlLCAic3JjIikpCisgICAgICAgICAgICBpZiAoaXNVUkxQYXJhbWV0 ZXIodmFsdWUpKQogICAgICAgICAgICAgICAgIHJldHVybiB0cnVlOwogICAgICAgICB9CiAgICAg fQpAQCAtNzUsMTEgKzgwLDkgQEAgdm9pZCBIVE1MUGFyYW1FbGVtZW50OjphZGRTdWJyZXNvdXJj ZUF0dHJpYnV0ZVVSTHMoTGlzdEhhc2hTZXQ8S1VSTD4mIHVybHMpIGNvbnMKIHsKICAgICBIVE1M RWxlbWVudDo6YWRkU3VicmVzb3VyY2VBdHRyaWJ1dGVVUkxzKHVybHMpOwogCi0gICAgaWYgKCFl cXVhbElnbm9yaW5nQ2FzZShuYW1lKCksICJkYXRhIikgJiYKLSAgICAgICAgIWVxdWFsSWdub3Jp bmdDYXNlKG5hbWUoKSwgIm1vdmllIikgJiYKLSAgICAgICAgIWVxdWFsSWdub3JpbmdDYXNlKG5h bWUoKSwgInNyYyIpKQorICAgIGlmICghaXNVUkxQYXJhbWV0ZXIobmFtZSgpKSkKICAgICAgICAg cmV0dXJuOwotICAgIAorCiAgICAgYWRkU3VicmVzb3VyY2VVUkwodXJscywgZG9jdW1lbnQoKS0+ Y29tcGxldGVVUkwodmFsdWUoKSkpOwogfQogCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9o dG1sL0hUTUxQYXJhbUVsZW1lbnQuaCBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTFBhcmFtRWxl bWVudC5oCmluZGV4IGYxM2Y4ZmE2MGMwOTM5ZDk0OWQ4YTc4ZTM2MjRkNDNhOWY3NTBiNTYuLmY0 NDg1NDdjYjA1ZGUxZWI2ODE3MDczZjk3ZmZlZTAxZjAyMjkxZTcgMTAwNjQ0Ci0tLSBhL1NvdXJj ZS9XZWJDb3JlL2h0bWwvSFRNTFBhcmFtRWxlbWVudC5oCisrKyBiL1NvdXJjZS9XZWJDb3JlL2h0 bWwvSFRNTFBhcmFtRWxlbWVudC5oCkBAIC0zNCw2ICszNCw4IEBAIHB1YmxpYzoKICAgICBTdHJp bmcgbmFtZSgpIGNvbnN0IHsgcmV0dXJuIG1fbmFtZTsgfQogICAgIFN0cmluZyB2YWx1ZSgpIGNv bnN0IHsgcmV0dXJuIG1fdmFsdWU7IH0KIAorICAgIHN0YXRpYyBib29sIGlzVVJMUGFyYW1ldGVy KGNvbnN0IFN0cmluZyYpOworCiBwcml2YXRlOgogICAgIEhUTUxQYXJhbUVsZW1lbnQoY29uc3Qg UXVhbGlmaWVkTmFtZSYsIERvY3VtZW50Kik7CiAKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3Jl L2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9Y U1NGaWx0ZXIuY3BwCmluZGV4IDM1YTU4MWVlOTY4NmZhMWNhNGFkM2NlMjE5NjMxZDA5YWYyMjI4 ZWMuLjgyNjMzZjJhYjg0MGI4MmRiNjI2YTA2MWY0YmFkMDFmNjVhZGZmNTMgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5jcHAKKysrIGIvU291cmNlL1dl YkNvcmUvaHRtbC9wYXJzZXIvWFNTRmlsdGVyLmNwcApAQCAtMzEsNiArMzEsNyBAQAogI2luY2x1 ZGUgIkZyYW1lLmgiCiAjaW5jbHVkZSAiSFRNTERvY3VtZW50UGFyc2VyLmgiCiAjaW5jbHVkZSAi SFRNTE5hbWVzLmgiCisjaW5jbHVkZSAiSFRNTFBhcmFtRWxlbWVudC5oIgogI2luY2x1ZGUgIkhU TUxQYXJzZXJJZGlvbXMuaCIKICNpbmNsdWRlICJTZXR0aW5ncy5oIgogI2luY2x1ZGUgIlRleHRF bmNvZGluZy5oIgpAQCAtMjA5LDYgKzIxMCw4IEBAIGJvb2wgWFNTRmlsdGVyOjpmaWx0ZXJUb2tl bkluaXRpYWwoSFRNTFRva2VuJiB0b2tlbikKICAgICAgICAgZGlkQmxvY2tTY3JpcHQgfD0gZmls dGVyU2NyaXB0VG9rZW4odG9rZW4pOwogICAgIGVsc2UgaWYgKGhhc05hbWUodG9rZW4sIG9iamVj dFRhZykpCiAgICAgICAgIGRpZEJsb2NrU2NyaXB0IHw9IGZpbHRlck9iamVjdFRva2VuKHRva2Vu KTsKKyAgICBlbHNlIGlmIChoYXNOYW1lKHRva2VuLCBwYXJhbVRhZykpCisgICAgICAgIGRpZEJs b2NrU2NyaXB0IHw9IGZpbHRlclBhcmFtVG9rZW4odG9rZW4pOwogICAgIGVsc2UgaWYgKGhhc05h bWUodG9rZW4sIGVtYmVkVGFnKSkKICAgICAgICAgZGlkQmxvY2tTY3JpcHQgfD0gZmlsdGVyRW1i ZWRUb2tlbih0b2tlbik7CiAgICAgZWxzZSBpZiAoaGFzTmFtZSh0b2tlbiwgYXBwbGV0VGFnKSkK QEAgLTI3Miw2ICsyNzUsMjUgQEAgYm9vbCBYU1NGaWx0ZXI6OmZpbHRlck9iamVjdFRva2VuKEhU TUxUb2tlbiYgdG9rZW4pCiAgICAgcmV0dXJuIGRpZEJsb2NrU2NyaXB0OwogfQogCitib29sIFhT U0ZpbHRlcjo6ZmlsdGVyUGFyYW1Ub2tlbihIVE1MVG9rZW4mIHRva2VuKQoreworICAgIEFTU0VS VChtX3N0YXRlID09IEluaXRpYWwpOworICAgIEFTU0VSVCh0b2tlbi50eXBlKCkgPT0gSFRNTFRv a2VuOjpTdGFydFRhZyk7CisgICAgQVNTRVJUKGhhc05hbWUodG9rZW4sIHBhcmFtVGFnKSk7CisK KyAgICBzaXplX3QgaW5kZXhPZk5hbWVBdHRyaWJ1dGU7CisgICAgaWYgKCFmaW5kQXR0cmlidXRl V2l0aE5hbWUodG9rZW4sIG5hbWVBdHRyLCBpbmRleE9mTmFtZUF0dHJpYnV0ZSkpCisgICAgICAg IHJldHVybiBmYWxzZTsKKworICAgIGNvbnN0IEhUTUxUb2tlbjo6QXR0cmlidXRlJiBuYW1lQXR0 cmlidXRlID0gdG9rZW4uYXR0cmlidXRlcygpLmF0KGluZGV4T2ZOYW1lQXR0cmlidXRlKTsKKyAg ICBTdHJpbmcgbmFtZSA9IFN0cmluZyhuYW1lQXR0cmlidXRlLm1fdmFsdWUuZGF0YSgpLCBuYW1l QXR0cmlidXRlLm1fdmFsdWUuc2l6ZSgpKTsKKworICAgIGlmICghSFRNTFBhcmFtRWxlbWVudDo6 aXNVUkxQYXJhbWV0ZXIobmFtZSkpCisgICAgICAgIHJldHVybiBmYWxzZTsKKworICAgIHJldHVy biBlcmFzZUF0dHJpYnV0ZUlmSW5qZWN0ZWQodG9rZW4sIHZhbHVlQXR0ciwgYmxhbmtVUkwoKS5z dHJpbmcoKSk7Cit9CisKIGJvb2wgWFNTRmlsdGVyOjpmaWx0ZXJFbWJlZFRva2VuKEhUTUxUb2tl biYgdG9rZW4pCiB7CiAgICAgQVNTRVJUKG1fc3RhdGUgPT0gSW5pdGlhbCk7CmRpZmYgLS1naXQg YS9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9YU1NGaWx0ZXIuaCBiL1NvdXJjZS9XZWJDb3Jl L2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5oCmluZGV4IDY5OTJiYjJlMzViYzc1MTVjM2NiOGE0ZWE5 YTg5ZGFjNDRlMDBmNmQuLjA4YmMxZGQ4MzAzMzQwMGIxOTg0Nzk5MGQ4ZjcyZjQ0MjYwMWRiZjIg MTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5oCisrKyBi L1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5oCkBAIC01Myw2ICs1Myw3IEBA IHByaXZhdGU6CiAKICAgICBib29sIGZpbHRlclNjcmlwdFRva2VuKEhUTUxUb2tlbiYpOwogICAg IGJvb2wgZmlsdGVyT2JqZWN0VG9rZW4oSFRNTFRva2VuJik7CisgICAgYm9vbCBmaWx0ZXJQYXJh bVRva2VuKEhUTUxUb2tlbiYpOwogICAgIGJvb2wgZmlsdGVyRW1iZWRUb2tlbihIVE1MVG9rZW4m KTsKICAgICBib29sIGZpbHRlckFwcGxldFRva2VuKEhUTUxUb2tlbiYpOwogICAgIGJvb2wgZmls dGVyTWV0YVRva2VuKEhUTUxUb2tlbiYpOwo=