Bug 60489 – XSSAuditor should be more selective about the <meta http-equivs> that it blocks

• Component: New Bugs
• Status: RESOLVED FIXED

[Adam Barth]

XSSAuditor should be more selective about the <meta http-equivs> that it blocks

[Adam Barth]

Created attachment 92815 [details]
Patch

[Daniel Bates]

Comment on attachment 92815 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=92815&action=review

> Source/WebCore/ChangeLog:28
> +        (WebCore::isNonCanonicalCharacter):
> +        (WebCore::canonicalize):
> +        (WebCore::isRequiredForInjection):
> +        (WebCore::hasName):
> +        (WebCore::findAttributeWithName):
> +        (WebCore::isNameOfInlineEventHandler):
> +        (WebCore::isDangerousHTTPEquiv):
> +        (WebCore::containsJavaScriptURL):
> +        (WebCore::decodeURL):
> +        (WebCore::XSSFilter::eraseAttributeIfInjected):

Most of the changes to these methods is because this patch moves them from being in an anonymous namespace to being static functions. So, as to demarcate the syntactic change from the actual change for this bug I suggest adding a remark to the right of isDangerousHTTPEquiv to mention that it was added and add some sort of remark to the other functions (or general sentence to the commit message) to describe the syntactic changes. Alternatively, you could split this into two patches/bugs. One to move the methods from being in an anonymous namespace to being static functions. And one patch/bug to actually make the change described in this bug.

[Daniel Bates]

Comment on attachment 92815 [details]
Patch

Also, can we test this change?

[Adam Barth]

Created attachment 92821 [details]
Patch for landing

[Adam Barth]

Comment on attachment 92821 [details]
Patch for landing

Updated patch.  Eric and I were discussing how and whether we want a test for this patch.

[Adam Barth]

Created attachment 92826 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 92826 [details]
Patch for landing

Clearing flags on attachment: 92826

Committed r86087: <http://trac.webkit.org/changeset/86087>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.