Bug 27179 – Facebook Chat is broken due to XSS auditor

• Component: Page Loading
• Status: RESOLVED FIXED

[John Kieken]

PPC - OS 10.4.11

The latest build of Webkit (r45752) has broken Facebook Chat (Instant Messaging).  Problem started only with the latest Webkit build (r45752) as of 7/11/09 1:04 PM

10 or 20 seconds after loading the page, Facebook Chat disconnects permanently and messages cannot be sent.  Reloading the page reconnects chat but it again disconnects.  No chat messages can be sent even before it disconnects.

Not a local router/port/firewall issue as Firefox is working normally on same machine.

[Mark Rowe (bdash)]

This is caused by the XSS auditor:
> Refused to execute a JavaScript script. Source code of script found within request.

[Adam Barth]

Ouch.  I'll take a look at this.

[Adam Barth]

The chat feature uses an iframe that echos a URL parameter in the src property of a script tag.  The web site is not exploitable because the server validates the host name before echoing.  Unfortunately, there is not obvious connection between the iframe's host name (blah.blah.facebook.com) and the script's host name (foo.bar.fbcdn.net, Facebook's CDN).

I think the correct solution is to look for more of the token in the URL.  In this case "<script" etc.

[Daniel Bates]

Created attachment 32620 [details]
Proposed test case

A simple test case.

[Adam Barth]

Created attachment 32621 [details]
=Work in progress

[Adam Barth]

I've got to go to dinner now, but here's my current work in progress patch.  The idea is to grab a little more context from the tokenization prior to the URL and see if that shows up in the request.

[Adam Barth]

Created attachment 32636 [details]
Almost done patch.  Needs tests.

[Adam Barth]

Created attachment 32642 [details]
patch

[Oliver Hunt]

Comment on attachment 32642 [details]
patch

r=me

[Adam Barth]

Sending        LayoutTests/ChangeLog
Adding         LayoutTests/http/tests/security/xssAuditor/resources/echo-script-src.pl
Adding         LayoutTests/http/tests/security/xssAuditor/script-tag-src-redirect-safe-expected.txt
Adding         LayoutTests/http/tests/security/xssAuditor/script-tag-src-redirect-safe.html
Adding         LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-double-quote-expected.txt
Adding         LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-double-quote.html
Adding         LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-no-quote-expected.txt
Adding         LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-no-quote.html
Sending        WebCore/ChangeLog
Sending        WebCore/html/HTMLTokenizer.cpp
Sending        WebCore/html/HTMLTokenizer.h
Sending        WebCore/page/XSSAuditor.cpp
Sending        WebCore/page/XSSAuditor.h
Transmitting file data .............
Committed revision 45787.
http://trac.webkit.org/changeset/45787