88002 2012-05-31 12:12:07 -0700 XSSAuditor bypass with leading /*///*/ comment 2012-06-12 17:07:05 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar, XSSAuditor P2 Normal --- 1 tsepez tsepez abarth dbates webkit.review.bot oldest_to_newest 638626 0 tsepez 2012-05-31 12:12:07 -0700 Originally reported by k3170makan at http://code.google.com/p/chromium/issues/detail?id=130594 query string: ?name=%3Cscript%3E/*///*/alert(1);%3C/script%3E reflected vector: <script>/*///*/alert(1);</script> 638628 1 tsepez 2012-05-31 12:13:42 -0700 Off by two. The block: else if (startsMultiLineCommentAt(string, startPosition)) { if ((foundPosition = string.find("*/", startPosition)) != notFound) startPosition = foundPosition + 2; is matching /*/ as a complete comment, which it's not. Then when we look at the next characters, we see // which we interpret as a single line comment -- but the JS parser doesn't. 638668 2 145144 tsepez 2012-05-31 13:24:25 -0700 Created attachment 145144 patch/test 638672 3 tsepez 2012-05-31 13:26:08 -0700 Adam, please review. 638673 4 webkit.review.bot 2012-05-31 13:28:18 -0700 Attachment 145144 did not pass style-queue: Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/http..." exit_code: 1 LayoutTests/ChangeLog:8: Line contains tab character. [whitespace/tab] [5] LayoutTests/ChangeLog:9: Line contains tab character. [whitespace/tab] [5] Source/WebCore/ChangeLog:8: Line contains tab character. [whitespace/tab] [5] Total errors found: 3 in 5 files If any of these errors are false positives, please file a bug against check-webkit-style. 638674 5 145147 tsepez 2012-05-31 13:28:48 -0700 Created attachment 145147 patch/test/fix indent 638881 6 145147 webkit.review.bot 2012-05-31 18:31:39 -0700 Comment on attachment 145147 patch/test/fix indent Clearing flags on attachment: 145147 Committed r119184: <http://trac.webkit.org/changeset/119184> 638882 7 webkit.review.bot 2012-05-31 18:31:44 -0700 All reviewed patches have been landed. Closing bug. 647499 8 aestes 2012-06-12 17:07:05 -0700 <rdar://problem/11652371> 145144 2012-05-31 13:24:25 -0700 2012-05-31 13:28:48 -0700 patch/test patch_88002.txt text/plain 3602 tsepez SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDExOTEzNykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDEyLTA1LTMxICBUb20gU2Vw ZXogIDx0c2VwZXpAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFhTU0F1ZGl0b3IgYnlwYXNzIHdp dGggbGVhZGluZyAvKi8vLyovIGNvbW1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTg4MDAyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKwlGaXhlcyBpc3N1ZSBpbiB4c3NhdWRpdG9yJ3MgcGFyc2luZyBvZiAvKi8uCisK KyAgICAgICAgVGVzdDogaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL3NjcmlwdC10YWct d2l0aC10cmFpbGluZy1jb21tZW50NC5odG1sCisKKyAgICAgICAgKiBodG1sL3BhcnNlci9YU1NB dWRpdG9yLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlhTU0F1ZGl0b3I6OmRlY29kZWRTbmlwcGV0 Rm9ySmF2YVNjcmlwdCk6CisKIDIwMTItMDUtMzEgIEJyYWR5IEVpZHNvbiAgPGJlaWRzb25AYXBw bGUuY29tPgogCiAgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8xMTU0NDQ1ND4gYW5kIGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04Nzk5MApJbmRleDogU291cmNlL1dlYkNv cmUvaHRtbC9wYXJzZXIvWFNTQXVkaXRvci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNv cmUvaHRtbC9wYXJzZXIvWFNTQXVkaXRvci5jcHAJKHJldmlzaW9uIDExOTEzNCkKKysrIFNvdXJj ZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0F1ZGl0b3IuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC01 NTcsNyArNTU3LDcgQEAgU3RyaW5nIFhTU0F1ZGl0b3I6OmRlY29kZWRTbmlwcGV0Rm9ySmF2YQog ICAgICAgICAgICAgd2hpbGUgKHN0YXJ0UG9zaXRpb24gPCBlbmRQb3NpdGlvbiAmJiAhaXNKU05l d2xpbmUoc3RyaW5nW3N0YXJ0UG9zaXRpb25dKSkKICAgICAgICAgICAgICAgICBzdGFydFBvc2l0 aW9uKys7CiAgICAgICAgIH0gZWxzZSBpZiAoc3RhcnRzTXVsdGlMaW5lQ29tbWVudEF0KHN0cmlu Zywgc3RhcnRQb3NpdGlvbikpIHsKLSAgICAgICAgICAgIGlmICgoZm91bmRQb3NpdGlvbiA9IHN0 cmluZy5maW5kKCIqLyIsIHN0YXJ0UG9zaXRpb24pKSAhPSBub3RGb3VuZCkKKyAgICAgICAgICAg IGlmIChzdGFydFBvc2l0aW9uICsgMiA8IGVuZFBvc2l0aW9uICYmIChmb3VuZFBvc2l0aW9uID0g c3RyaW5nLmZpbmQoIiovIiwgc3RhcnRQb3NpdGlvbiArIDIpKSAhPSBub3RGb3VuZCkKICAgICAg ICAgICAgICAgICBzdGFydFBvc2l0aW9uID0gZm91bmRQb3NpdGlvbiArIDI7CiAgICAgICAgICAg ICBlbHNlCiAgICAgICAgICAgICAgICAgc3RhcnRQb3NpdGlvbiA9IGVuZFBvc2l0aW9uOwpJbmRl eDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5n ZUxvZwkocmV2aXNpb24gMTE5MTM3KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5n IGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTItMDUtMzEgIFRvbSBTZXBleiAgPHRzZXBlekBj aHJvbWl1bS5vcmc+CisKKyAgICAgICAgWFNTQXVkaXRvciBieXBhc3Mgd2l0aCBsZWFkaW5nIC8q Ly8vKi8gY29tbWVudAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9ODgwMDIKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworCUZp eGVzIGlzc3VlIGluIHhzc2F1ZGl0b3IncyBwYXJzaW5nIG9mIC8qLy4KKwkKKyAgICAgICAgKiBo dHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRhZy13aXRoLXRyYWlsaW5nLWNv bW1lbnQ0LWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogaHR0cC90ZXN0cy9zZWN1cml0 eS94c3NBdWRpdG9yL3NjcmlwdC10YWctd2l0aC10cmFpbGluZy1jb21tZW50NC5odG1sOiBBZGRl ZC4KKwogMjAxMi0wNS0zMSAgWmFuIERvYmVyc2VrICA8emFuZG9iZXJzZWtAZ21haWwuY29tPgog CiAgICAgICAgIFVucmV2aWV3ZWQgZ2FyZGVuaW5nLCB1cGRhdGluZyBiYXNlbGluZXMgYWZ0ZXIg cjExOTEyNC4KSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRv ci9zY3JpcHQtdGFnLXdpdGgtdHJhaWxpbmctY29tbWVudDQtZXhwZWN0ZWQudHh0Cj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3JpcHQt dGFnLXdpdGgtdHJhaWxpbmctY29tbWVudDQtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysg TGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL3NjcmlwdC10YWctd2l0 aC10cmFpbGluZy1jb21tZW50NC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEs MyBAQAorQ09OU09MRSBNRVNTQUdFOiBSZWZ1c2VkIHRvIGV4ZWN1dGUgYSBKYXZhU2NyaXB0IHNj cmlwdC4gU291cmNlIGNvZGUgb2Ygc2NyaXB0IGZvdW5kIHdpdGhpbiByZXF1ZXN0LgorCisKSW5k ZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3JpcHQtdGFn LXdpdGgtdHJhaWxpbmctY29tbWVudDQuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9o dHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRhZy13aXRoLXRyYWlsaW5nLWNv bW1lbnQ0Lmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3Vy aXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRhZy13aXRoLXRyYWlsaW5nLWNvbW1lbnQ0Lmh0bWwJKHJl dmlzaW9uIDApCkBAIC0wLDAgKzEsMTUgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8aGVh ZD4KKzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKSB7CisgIGxheW91 dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAgbGF5b3V0VGVzdENvbnRyb2xsZXIuc2V0 WFNTQXVkaXRvckVuYWJsZWQodHJ1ZSk7Cit9Cis8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5Pgor PGlmcmFtZSBzcmM9Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC9zZWN1cml0eS94c3NBdWRpdG9yL3Jl c291cmNlcy9lY2hvLWludGVydGFnLnBsP3E9PHNjcmlwdD4vKi8vLyovYWxlcnQoU3RyaW5nLmZy b21DaGFyQ29kZSgweDU4LDB4NTMsMHg1MykpPC9zY3JpcHQ+Ij4KKzwvaWZyYW1lPgorPC9ib2R5 PgorPC9odG1sPgo= 145147 2012-05-31 13:28:48 -0700 2012-05-31 18:31:39 -0700 patch/test/fix indent patch_88002.txt text/plain 3623 tsepez SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDExOTEzNykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDEyLTA1LTMxICBUb20gU2Vw ZXogIDx0c2VwZXpAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFhTU0F1ZGl0b3IgYnlwYXNzIHdp dGggbGVhZGluZyAvKi8vLyovIGNvbW1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTg4MDAyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgRml4ZXMgaXNzdWUgaW4geHNzYXVkaXRvcidzIHBhcnNpbmcgb2Yg LyovLgorCisgICAgICAgIFRlc3Q6IGh0dHAvdGVzdHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3Jp cHQtdGFnLXdpdGgtdHJhaWxpbmctY29tbWVudDQuaHRtbAorCisgICAgICAgICogaHRtbC9wYXJz ZXIvWFNTQXVkaXRvci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpYU1NBdWRpdG9yOjpkZWNvZGVk U25pcHBldEZvckphdmFTY3JpcHQpOgorCiAyMDEyLTA1LTMxICBCcmFkeSBFaWRzb24gIDxiZWlk c29uQGFwcGxlLmNvbT4KIAogICAgICAgICA8cmRhcjovL3Byb2JsZW0vMTE1NDQ0NTQ+IGFuZCBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9ODc5OTAKSW5kZXg6IFNvdXJj ZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0F1ZGl0b3IuY3BwCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJj ZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0F1ZGl0b3IuY3BwCShyZXZpc2lvbiAxMTkxMzQpCisr KyBTb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9YU1NBdWRpdG9yLmNwcAkod29ya2luZyBjb3B5 KQpAQCAtNTU3LDcgKzU1Nyw3IEBAIFN0cmluZyBYU1NBdWRpdG9yOjpkZWNvZGVkU25pcHBldEZv ckphdmEKICAgICAgICAgICAgIHdoaWxlIChzdGFydFBvc2l0aW9uIDwgZW5kUG9zaXRpb24gJiYg IWlzSlNOZXdsaW5lKHN0cmluZ1tzdGFydFBvc2l0aW9uXSkpCiAgICAgICAgICAgICAgICAgc3Rh cnRQb3NpdGlvbisrOwogICAgICAgICB9IGVsc2UgaWYgKHN0YXJ0c011bHRpTGluZUNvbW1lbnRB dChzdHJpbmcsIHN0YXJ0UG9zaXRpb24pKSB7Ci0gICAgICAgICAgICBpZiAoKGZvdW5kUG9zaXRp b24gPSBzdHJpbmcuZmluZCgiKi8iLCBzdGFydFBvc2l0aW9uKSkgIT0gbm90Rm91bmQpCisgICAg ICAgICAgICBpZiAoc3RhcnRQb3NpdGlvbiArIDIgPCBlbmRQb3NpdGlvbiAmJiAoZm91bmRQb3Np dGlvbiA9IHN0cmluZy5maW5kKCIqLyIsIHN0YXJ0UG9zaXRpb24gKyAyKSkgIT0gbm90Rm91bmQp CiAgICAgICAgICAgICAgICAgc3RhcnRQb3NpdGlvbiA9IGZvdW5kUG9zaXRpb24gKyAyOwogICAg ICAgICAgICAgZWxzZQogICAgICAgICAgICAgICAgIHN0YXJ0UG9zaXRpb24gPSBlbmRQb3NpdGlv bjsKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0 cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDExOTEzNykKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwko d29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDEyLTA1LTMxICBUb20gU2VwZXogIDx0 c2VwZXpAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFhTU0F1ZGl0b3IgYnlwYXNzIHdpdGggbGVh ZGluZyAvKi8vLyovIGNvbW1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hv d19idWcuY2dpP2lkPTg4MDAyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgRml4ZXMgaXNzdWUgaW4geHNzYXVkaXRvcidzIHBhcnNpbmcgb2YgLyovLgor ICAgICAgICAKKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0 LXRhZy13aXRoLXRyYWlsaW5nLWNvbW1lbnQ0LWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAg ICogaHR0cC90ZXN0cy9zZWN1cml0eS94c3NBdWRpdG9yL3NjcmlwdC10YWctd2l0aC10cmFpbGlu Zy1jb21tZW50NC5odG1sOiBBZGRlZC4KKwogMjAxMi0wNS0zMSAgWmFuIERvYmVyc2VrICA8emFu ZG9iZXJzZWtAZ21haWwuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQgZ2FyZGVuaW5nLCB1cGRh dGluZyBiYXNlbGluZXMgYWZ0ZXIgcjExOTEyNC4KSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVz dHMvc2VjdXJpdHkveHNzQXVkaXRvci9zY3JpcHQtdGFnLXdpdGgtdHJhaWxpbmctY29tbWVudDQt ZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJp dHkveHNzQXVkaXRvci9zY3JpcHQtdGFnLXdpdGgtdHJhaWxpbmctY29tbWVudDQtZXhwZWN0ZWQu dHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9zZWN1cml0eS94c3NB dWRpdG9yL3NjcmlwdC10YWctd2l0aC10cmFpbGluZy1jb21tZW50NC1leHBlY3RlZC50eHQJKHJl dmlzaW9uIDApCkBAIC0wLDAgKzEsMyBAQAorQ09OU09MRSBNRVNTQUdFOiBSZWZ1c2VkIHRvIGV4 ZWN1dGUgYSBKYXZhU2NyaXB0IHNjcmlwdC4gU291cmNlIGNvZGUgb2Ygc2NyaXB0IGZvdW5kIHdp dGhpbiByZXF1ZXN0LgorCisKSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkv eHNzQXVkaXRvci9zY3JpcHQtdGFnLXdpdGgtdHJhaWxpbmctY29tbWVudDQuaHRtbAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0 LXRhZy13aXRoLXRyYWlsaW5nLWNvbW1lbnQ0Lmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRU ZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3hzc0F1ZGl0b3Ivc2NyaXB0LXRhZy13aXRoLXRyYWls aW5nLWNvbW1lbnQ0Lmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTUgQEAKKzwhRE9DVFlQ RSBodG1sPgorPGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RD b250cm9sbGVyKSB7CisgIGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAgbGF5 b3V0VGVzdENvbnRyb2xsZXIuc2V0WFNTQXVkaXRvckVuYWJsZWQodHJ1ZSk7Cit9Cis8L3Njcmlw dD4KKzwvaGVhZD4KKzxib2R5PgorPGlmcmFtZSBzcmM9Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC9z ZWN1cml0eS94c3NBdWRpdG9yL3Jlc291cmNlcy9lY2hvLWludGVydGFnLnBsP3E9PHNjcmlwdD4v Ki8vLyovYWxlcnQoU3RyaW5nLmZyb21DaGFyQ29kZSgweDU4LDB4NTMsMHg1MykpPC9zY3JpcHQ+ Ij4KKzwvaWZyYW1lPgorPC9ib2R5PgorPC9odG1sPgo=