| Summary: | XSSAuditor should be more selective about the <meta http-equivs> that it blocks | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Adam Barth <abarth> | ||||||||
| Component: | New Bugs | Assignee: | Adam Barth <abarth> | ||||||||
| Status: | RESOLVED FIXED | ||||||||||
| Severity: | Normal | CC: | commit-queue, dbates, eric | ||||||||
| Priority: | P2 | ||||||||||
| Version: | 528+ (Nightly build) | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Adam Barth
2011-05-09 11:48:28 PDT
Created attachment 92815 [details]
Patch
Comment on attachment 92815 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=92815&action=review > Source/WebCore/ChangeLog:28 > + (WebCore::isNonCanonicalCharacter): > + (WebCore::canonicalize): > + (WebCore::isRequiredForInjection): > + (WebCore::hasName): > + (WebCore::findAttributeWithName): > + (WebCore::isNameOfInlineEventHandler): > + (WebCore::isDangerousHTTPEquiv): > + (WebCore::containsJavaScriptURL): > + (WebCore::decodeURL): > + (WebCore::XSSFilter::eraseAttributeIfInjected): Most of the changes to these methods is because this patch moves them from being in an anonymous namespace to being static functions. So, as to demarcate the syntactic change from the actual change for this bug I suggest adding a remark to the right of isDangerousHTTPEquiv to mention that it was added and add some sort of remark to the other functions (or general sentence to the commit message) to describe the syntactic changes. Alternatively, you could split this into two patches/bugs. One to move the methods from being in an anonymous namespace to being static functions. And one patch/bug to actually make the change described in this bug. Comment on attachment 92815 [details]
Patch
Also, can we test this change?
Created attachment 92821 [details]
Patch for landing
Comment on attachment 92821 [details]
Patch for landing
Updated patch. Eric and I were discussing how and whether we want a test for this patch.
Created attachment 92826 [details]
Patch for landing
Comment on attachment 92826 [details] Patch for landing Clearing flags on attachment: 92826 Committed r86087: <http://trac.webkit.org/changeset/86087> All reviewed patches have been landed. Closing bug. |