Bug 39249 – REGRESSION (r56295): Can't create a new wave on Google Wave

• Component: Page Loading
• Status: RESOLVED FIXED

[Alexey Proskuryakov]

Observed with r59204 nightly.

Steps to reproduce:
1. Log in to Google Wave.
2. Click "New Wave" at the right.

Results: window navigates to about:blank.
Expected results: a new wave should appear at the right.

[Alexey Proskuryakov]

<rdar://problem/7994854>

[Alexey Proskuryakov]

Works in r56294, fails in r56295.

[Alexey Proskuryakov]

The main resource has " X-Xss-Protection:1; mode=block".

[Daniel Bates]

(In reply to comment #0)
> Observed with r59204 nightly.
> 
> Steps to reproduce:
> 1. Log in to Google Wave.
> 2. Click "New Wave" at the right.
> 
> Results: window navigates to about:blank.
> Expected results: a new wave should appear at the right.

I am unable to reproduce following the aforementioned steps with r59204 nightly and using my Google account. I tried resetting Safari (Safari->Reset Safari), then following the steps, to no avail. Do you happen to have a copy of the console messages when this occurred? Do you have any additional information on this issue?

[Alexey Proskuryakov]

It seems to only happen for some people, maybe Google serves different code versions?

The link is <a href="javascript:;"> with some even listeners installed. 

Below is JS Console output:

HTML WARN: The page at https://wave.google.com/wave/ displayed insecure content from http://lh3.ggpht.com/__n9uIWxqWWk/SwXq4UxcJjI/AAAAAAAAA9k/Jk0EV1lvgMc/s104-c/IMG_1611.jpg.

HTML WARN: The page at https://wave.google.com/wave/ displayed insecure content from http://lh3.ggpht.com/__n9uIWxqWWk/SwXq4UxcJjI/AAAAAAAAA9k/Jk0EV1lvgMc/s104-c/IMG_1611.jpg.

JS ERROR: Refused to execute a JavaScript script. Source code of script found within request.

https://wave.google.com/wave/static/5DEB8B560FCA74C2AA4974967ED07055.cache.js:4218: JS ERROR: TypeError: Result of expression '(v.Y?$doc.getElementById(d):Upb(v,d))' [null] is not an object.

[Alexey Proskuryakov]

I know! I have a semicolon in my Google Wave password - this is why others can't reproduce.

[Daniel Bates]

Created attachment 56332 [details]
Patch with test case

Pass the schema portion of a JavaScript URL to the XSSAuditor as additional context.

[WebKit Review Bot]

Attachment 56332 [details] did not build on chromium:
Build output: http://webkit-commit-queue.appspot.com/results/2287234

[Daniel Bates]

Comment on attachment 56332 [details]
Patch with test case

Need to add the equivalent changes to the v8 bindings.

[Daniel Bates]

Created attachment 56464 [details]
Patch with test case

Updated patch with changes to V8 bindings and added missing file "http/tests/security/xssAuditor/resources/javascript-link-safe.html".

[WebKit Review Bot]

Attachment 56464 [details] did not build on chromium:
Build output: http://webkit-commit-queue.appspot.com/results/2273312

[Daniel Bates]

Created attachment 56473 [details]
Patch with test case

[Daniel Bates]

Created attachment 56474 [details]
Patch with test case

Fixed V8 prototype for ScriptController::executeIfJavaScriptURL

[Alexey Proskuryakov]

Adam, is this something you'd be willing to review?

[Adam Barth]

I'd be happy to.  I'm at W2SP today, but I'll try to review it tonight.

[Adam Barth]

Comment on attachment 56474 [details]
Patch with test case

Very nice.

[Daniel Bates]

Committed r60014: <http://trac.webkit.org/changeset/60014>

[Alexey Proskuryakov]

*** Bug 38137 has been marked as a duplicate of this bug. ***

[Ain Tohvri]

Behaviour described in bug 39186 is still there in latest r60027.