54591 2011-02-16 14:56:48 -0800 Fix xssAuditor/iframe-injection.html 2011-02-19 00:12:23 -0800 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Other OS X 10.5 RESOLVED FIXED P2 Normal --- 1 abarth abarth commit-queue dbates eric oldest_to_newest 352388 0 abarth 2011-02-16 14:56:48 -0800 Fix xssAuditor/iframe-injection.html 352389 1 82705 abarth 2011-02-16 14:57:54 -0800 Created attachment 82705 Patch 352391 2 82705 dbates 2011-02-16 15:02:48 -0800 Comment on attachment 82705 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=82705&action=review > Source/WebCore/ChangeLog:8 > + We should block form actions. Although this technically can't be used You mean "block the iframe src attribute". 353895 3 83030 abarth 2011-02-18 15:46:04 -0800 Created attachment 83030 Patch for landing 354091 4 83030 commit-queue 2011-02-19 00:12:18 -0800 Comment on attachment 83030 Patch for landing Clearing flags on attachment: 83030 Committed r79106: <http://trac.webkit.org/changeset/79106> 354092 5 commit-queue 2011-02-19 00:12:23 -0800 All reviewed patches have been landed. Closing bug. 82705 2011-02-16 14:57:54 -0800 2011-02-18 15:46:01 -0800 Patch bug-54591-20110216145753.patch text/plain 3906 abarth U3VidmVyc2lvbiBSZXZpc2lvbjogNzg3MjUKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5n ZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBhOTVmODM3ZDQ5N2U5YWU4NzNlMWQ0 NGJkYzhjZmZmOThhNjRjNjY5Li5kNzY2YmQ1YmEzNDg1NmM3MmJjZWIxMzIyMjFiZTRkN2ExNzdk MWQwIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCkBAIC0yLDYgKzIsMTcgQEAKIAogICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KIAorICAgICAgICBGaXggeHNzQXVkaXRvci9pZnJhbWUtaW5qZWN0aW9uLmh0bWwK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU0NTkxCisK KyAgICAgICAgVXBkYXRlIGV4cGVjdGVkIHJlc3VsdHMgdG8gc2hvdyB0aGF0IHdlIHBhc3MuCisK KyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3IvaWZyYW1lLWluamVjdGlv bi1leHBlY3RlZC50eHQ6CisKKzIwMTEtMDItMTYgIEFkYW0gQmFydGggIDxhYmFydGhAd2Via2l0 Lm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwogICAgICAgICBG aXggeHNzQXVkaXRvci9mb3JtLWFjdGlvbi5odG1sCiAgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD01NDU5MAogCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9o dHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3IvaWZyYW1lLWluamVjdGlvbi1leHBlY3RlZC50 eHQgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3IvaWZyYW1lLWlu amVjdGlvbi1leHBlY3RlZC50eHQKaW5kZXggOGIxMzc4OTE3OTFmZTk2OTI3YWQ3OGU2NGIwYWFk N2JkZWQwOGJkYy4uNTEzZTJmOGQwM2Y3NDIwM2EzNWUwYmVlZDFmZDQzYjQzMjkyZGMyZiAxMDA2 NDQKLS0tIGEvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL2lmcmFt ZS1pbmplY3Rpb24tZXhwZWN0ZWQudHh0CisrKyBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvc2Vj dXJpdHkveHNzQXVkaXRvci9pZnJhbWUtaW5qZWN0aW9uLWV4cGVjdGVkLnR4dApAQCAtMSArMSwz IEBACitDT05TT0xFIE1FU1NBR0U6IGxpbmUgMTogUmVmdXNlZCB0byBleGVjdXRlIGEgSmF2YVNj cmlwdCBzY3JpcHQuIFNvdXJjZSBjb2RlIG9mIHNjcmlwdCBmb3VuZCB3aXRoaW4gcmVxdWVzdC4K KwogCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29y ZS9DaGFuZ2VMb2cKaW5kZXggODVkNDQ1MmM1NjU0MGVkMzRmMGNhYjFiMmNjMzZlZTU2NzBkMjNh OC4uYWQwNGFmOWMxYTVlYWJjN2NkZTg5NGI2ZDkwYWVjZjc3NjM4ZWJmNyAxMDA2NDQKLS0tIGEv U291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpA QCAtMiw2ICsyLDIxIEBACiAKICAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCiAK KyAgICAgICAgRml4IHhzc0F1ZGl0b3IvaWZyYW1lLWluamVjdGlvbi5odG1sCisgICAgICAgIGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD01NDU5MQorCisgICAgICAgIFdl IHNob3VsZCBibG9jayBmb3JtIGFjdGlvbnMuICBBbHRob3VnaCB0aGlzIHRlY2huaWNhbGx5IGNh bid0IGJlIHVzZWQKKyAgICAgICAgdG8gcnVuIHNjcmlwdCwgaXQncyBhIHByZXR0eSBlYXN5IHZl Y3RvciBmb3Igc3RlYWxpbmcgcGFzc3dvcmRzLgorCisgICAgICAgICogaHRtbC9wYXJzZXIvWFNT RmlsdGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlhTU0ZpbHRlcjo6ZmlsdGVyVG9rZW5Jbml0 aWFsKToKKyAgICAgICAgKFdlYkNvcmU6OlhTU0ZpbHRlcjo6ZmlsdGVySWZyYW1lVG9rZW4pOgor ICAgICAgICAqIGh0bWwvcGFyc2VyL1hTU0ZpbHRlci5oOgorCisyMDExLTAyLTE2ICBBZGFtIEJh cnRoICA8YWJhcnRoQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKICAgICAgICAgRml4IHhzc0F1ZGl0b3IvZm9ybS1hY3Rpb24uaHRtbAogICAgICAg ICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NTQ1OTAKIApkaWZmIC0t Z2l0IGEvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvWFNTRmlsdGVyLmNwcCBiL1NvdXJjZS9X ZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5jcHAKaW5kZXggZDc4NjE1Y2Q1MzAwZWJkZTQ3 ODQ5NjU1NzhhOWQyNTRiNzg1MmU5MS4uZGRjMzMxODIwMDcxZjAzMWU2YzAxOTg2MDQ3ZTZiMmRm NjdjMWU0NyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvWFNTRmlsdGVy LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9YU1NGaWx0ZXIuY3BwCkBAIC0y NDUsNiArMjQ1LDggQEAgYm9vbCBYU1NGaWx0ZXI6OmZpbHRlclRva2VuSW5pdGlhbChIVE1MVG9r ZW4mIHRva2VuKQogICAgICAgICBkaWRCbG9ja1NjcmlwdCB8PSBmaWx0ZXJFbWJlZFRva2VuKHRv a2VuKTsKICAgICBlbHNlIGlmIChoYXNOYW1lKHRva2VuLCBhcHBsZXRUYWcpKQogICAgICAgICBk aWRCbG9ja1NjcmlwdCB8PSBmaWx0ZXJBcHBsZXRUb2tlbih0b2tlbik7CisgICAgZWxzZSBpZiAo aGFzTmFtZSh0b2tlbiwgaWZyYW1lVGFnKSkKKyAgICAgICAgZGlkQmxvY2tTY3JpcHQgfD0gZmls dGVySWZyYW1lVG9rZW4odG9rZW4pOwogICAgIGVsc2UgaWYgKGhhc05hbWUodG9rZW4sIG1ldGFU YWcpKQogICAgICAgICBkaWRCbG9ja1NjcmlwdCB8PSBmaWx0ZXJNZXRhVG9rZW4odG9rZW4pOwog ICAgIGVsc2UgaWYgKGhhc05hbWUodG9rZW4sIGJhc2VUYWcpKQpAQCAtMzUzLDYgKzM1NSwxNSBA QCBib29sIFhTU0ZpbHRlcjo6ZmlsdGVyQXBwbGV0VG9rZW4oSFRNTFRva2VuJiB0b2tlbikKICAg ICByZXR1cm4gZGlkQmxvY2tTY3JpcHQ7CiB9CiAKK2Jvb2wgWFNTRmlsdGVyOjpmaWx0ZXJJZnJh bWVUb2tlbihIVE1MVG9rZW4mIHRva2VuKQoreworICAgIEFTU0VSVChtX3N0YXRlID09IEluaXRp YWwpOworICAgIEFTU0VSVCh0b2tlbi50eXBlKCkgPT0gSFRNTFRva2VuOjpTdGFydFRhZyk7Cisg ICAgQVNTRVJUKGhhc05hbWUodG9rZW4sIGlmcmFtZVRhZykpOworCisgICAgcmV0dXJuIGVyYXNl QXR0cmlidXRlSWZJbmplY3RlZCh0b2tlbiwgc3JjQXR0cik7Cit9CisKIGJvb2wgWFNTRmlsdGVy OjpmaWx0ZXJNZXRhVG9rZW4oSFRNTFRva2VuJiB0b2tlbikKIHsKICAgICBBU1NFUlQobV9zdGF0 ZSA9PSBJbml0aWFsKTsKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hT U0ZpbHRlci5oIGIvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvWFNTRmlsdGVyLmgKaW5kZXgg NTE5YTcxNDk0Njg1NWEyMDg2MzE5NGRkZmQ4YjVmZjEzNzVhNWUxMi4uYzliYTEyZThlNzc5MTIw NTcwZTJiYmIyNGZlYzdkM2Y5Mjc0ZTVkOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaHRt bC9wYXJzZXIvWFNTRmlsdGVyLmgKKysrIGIvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvWFNT RmlsdGVyLmgKQEAgLTU4LDYgKzU4LDcgQEAgcHJpdmF0ZToKICAgICBib29sIGZpbHRlclBhcmFt VG9rZW4oSFRNTFRva2VuJik7CiAgICAgYm9vbCBmaWx0ZXJFbWJlZFRva2VuKEhUTUxUb2tlbiYp OwogICAgIGJvb2wgZmlsdGVyQXBwbGV0VG9rZW4oSFRNTFRva2VuJik7CisgICAgYm9vbCBmaWx0 ZXJJZnJhbWVUb2tlbihIVE1MVG9rZW4mKTsKICAgICBib29sIGZpbHRlck1ldGFUb2tlbihIVE1M VG9rZW4mKTsKICAgICBib29sIGZpbHRlckJhc2VUb2tlbihIVE1MVG9rZW4mKTsKICAgICBib29s IGZpbHRlckZvcm1Ub2tlbihIVE1MVG9rZW4mKTsK 83030 2011-02-18 15:46:04 -0800 2011-02-19 00:12:18 -0800 Patch for landing bug-54591-20110218154603.patch text/plain 3555 abarth SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDc5MDMzKQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTkgQEAKKzIwMTEtMDItMTggIEFkYW0gQmFy dGggIDxhYmFydGhAd2Via2l0Lm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBEYW5pZWwgQmF0 ZXMuCisKKyAgICAgICAgRml4IHhzc0F1ZGl0b3IvaWZyYW1lLWluamVjdGlvbi5odG1sCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD01NDU5MQorCisgICAg ICAgIFdlIHNob3VsZCBibG9jayB0aGUgaWZyYW1lIHNyYyBhdHRyaWJ1dGUuICBBbHRob3VnaCB0 aGlzIHRlY2huaWNhbGx5CisgICAgICAgIGNhbid0IGJlIHVzZWQgdG8gcnVuIHNjcmlwdCwgaXQn cyBhIHByZXR0eSBlYXN5IHZlY3RvciBmb3Igc3RlYWxpbmcKKyAgICAgICAgcGFzc3dvcmRzLgor CisgICAgICAgICogaHRtbC9wYXJzZXIvWFNTRmlsdGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6 OlhTU0ZpbHRlcjo6ZmlsdGVyVG9rZW5Jbml0aWFsKToKKyAgICAgICAgKFdlYkNvcmU6OlhTU0Zp bHRlcjo6ZmlsdGVySWZyYW1lVG9rZW4pOgorICAgICAgICAqIGh0bWwvcGFyc2VyL1hTU0ZpbHRl ci5oOgorCiAyMDExLTAyLTE4ICBKYW1lcyBSb2JpbnNvbiAgPGphbWVzckBjaHJvbWl1bS5vcmc+ CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgS2VubmV0aCBSdXNzZWxsLgpJbmRleDogU291cmNlL1dl YkNvcmUvaHRtbC9wYXJzZXIvWFNTRmlsdGVyLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9odG1sL3BhcnNlci9YU1NGaWx0ZXIuY3BwCShyZXZpc2lvbiA3OTAzMykKKysrIFNvdXJj ZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTI0 NSw2ICsyNDUsOCBAQCBib29sIFhTU0ZpbHRlcjo6ZmlsdGVyVG9rZW5Jbml0aWFsKEhUTUxUCiAg ICAgICAgIGRpZEJsb2NrU2NyaXB0IHw9IGZpbHRlckVtYmVkVG9rZW4odG9rZW4pOwogICAgIGVs c2UgaWYgKGhhc05hbWUodG9rZW4sIGFwcGxldFRhZykpCiAgICAgICAgIGRpZEJsb2NrU2NyaXB0 IHw9IGZpbHRlckFwcGxldFRva2VuKHRva2VuKTsKKyAgICBlbHNlIGlmIChoYXNOYW1lKHRva2Vu LCBpZnJhbWVUYWcpKQorICAgICAgICBkaWRCbG9ja1NjcmlwdCB8PSBmaWx0ZXJJZnJhbWVUb2tl bih0b2tlbik7CiAgICAgZWxzZSBpZiAoaGFzTmFtZSh0b2tlbiwgbWV0YVRhZykpCiAgICAgICAg IGRpZEJsb2NrU2NyaXB0IHw9IGZpbHRlck1ldGFUb2tlbih0b2tlbik7CiAgICAgZWxzZSBpZiAo aGFzTmFtZSh0b2tlbiwgYmFzZVRhZykpCkBAIC0zNTMsNiArMzU1LDE1IEBAIGJvb2wgWFNTRmls dGVyOjpmaWx0ZXJBcHBsZXRUb2tlbihIVE1MVG8KICAgICByZXR1cm4gZGlkQmxvY2tTY3JpcHQ7 CiB9CiAKK2Jvb2wgWFNTRmlsdGVyOjpmaWx0ZXJJZnJhbWVUb2tlbihIVE1MVG9rZW4mIHRva2Vu KQoreworICAgIEFTU0VSVChtX3N0YXRlID09IEluaXRpYWwpOworICAgIEFTU0VSVCh0b2tlbi50 eXBlKCkgPT0gSFRNTFRva2VuOjpTdGFydFRhZyk7CisgICAgQVNTRVJUKGhhc05hbWUodG9rZW4s IGlmcmFtZVRhZykpOworCisgICAgcmV0dXJuIGVyYXNlQXR0cmlidXRlSWZJbmplY3RlZCh0b2tl biwgc3JjQXR0cik7Cit9CisKIGJvb2wgWFNTRmlsdGVyOjpmaWx0ZXJNZXRhVG9rZW4oSFRNTFRv a2VuJiB0b2tlbikKIHsKICAgICBBU1NFUlQobV9zdGF0ZSA9PSBJbml0aWFsKTsKSW5kZXg6IFNv dXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5oCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJj ZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5oCShyZXZpc2lvbiA3OTAzMykKKysrIFNv dXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5oCSh3b3JraW5nIGNvcHkpCkBAIC01 OCw2ICs1OCw3IEBAIHByaXZhdGU6CiAgICAgYm9vbCBmaWx0ZXJQYXJhbVRva2VuKEhUTUxUb2tl biYpOwogICAgIGJvb2wgZmlsdGVyRW1iZWRUb2tlbihIVE1MVG9rZW4mKTsKICAgICBib29sIGZp bHRlckFwcGxldFRva2VuKEhUTUxUb2tlbiYpOworICAgIGJvb2wgZmlsdGVySWZyYW1lVG9rZW4o SFRNTFRva2VuJik7CiAgICAgYm9vbCBmaWx0ZXJNZXRhVG9rZW4oSFRNTFRva2VuJik7CiAgICAg Ym9vbCBmaWx0ZXJCYXNlVG9rZW4oSFRNTFRva2VuJik7CiAgICAgYm9vbCBmaWx0ZXJGb3JtVG9r ZW4oSFRNTFRva2VuJik7CkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lvbiA3OTAzMykKKysrIExheW91dFRlc3Rz L0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDExLTAyLTE4ICBB ZGFtIEJhcnRoICA8YWJhcnRoQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgRGFu aWVsIEJhdGVzLgorCisgICAgICAgIEZpeCB4c3NBdWRpdG9yL2lmcmFtZS1pbmplY3Rpb24uaHRt bAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NTQ1OTEK KworICAgICAgICBVcGRhdGUgZXhwZWN0ZWQgcmVzdWx0cyB0byBzaG93IHRoYXQgd2UgcGFzcy4K KworICAgICAgICAqIGh0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9pZnJhbWUtaW5qZWN0 aW9uLWV4cGVjdGVkLnR4dDoKKwogMjAxMS0wMi0xOCAgTWFoZXNoIEt1bGthcm5pICA8bWFoZXNo Lmt1bGthcm5pQG5va2lhLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBLZW5uZXRoIFJvaGRl IENocmlzdGlhbnNlbi4KSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNz QXVkaXRvci9pZnJhbWUtaW5qZWN0aW9uLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlv dXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3IvaWZyYW1lLWluamVjdGlvbi1l eHBlY3RlZC50eHQJKHJldmlzaW9uIDc5MDMzKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9z ZWN1cml0eS94c3NBdWRpdG9yL2lmcmFtZS1pbmplY3Rpb24tZXhwZWN0ZWQudHh0CSh3b3JraW5n IGNvcHkpCkBAIC0xICsxLDMgQEAKK0NPTlNPTEUgTUVTU0FHRTogbGluZSAxOiBSZWZ1c2VkIHRv IGV4ZWN1dGUgYSBKYXZhU2NyaXB0IHNjcmlwdC4gU291cmNlIGNvZGUgb2Ygc2NyaXB0IGZvdW5k IHdpdGhpbiByZXF1ZXN0LgorCiAK