Bug 69708

Summary:

Remove "near miss" XSS vulnerabilities in garden-o-matic

Product:

WebKit

Reporter:

Adam Barth <abarth>

Component:

New Bugs

Assignee:

Adam Barth <abarth>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

abarth, collinj, eric, levin, webkit.review.bot

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

Bug Blocks:

69227

Attachments:

Description	Flags
Patch	none
Patch for landing	none

Description Adam Barth 2011-10-08 14:05:28 PDT

Remove "near miss" XSS vulnerabilities in garden-o-matic

Comment 1 Adam Barth 2011-10-08 14:06:58 PDT

Created attachment 110282 [details]
Patch

Comment 2 David Levin 2011-10-09 18:58:07 PDT

Comment on attachment 110282 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=110282&action=review

> Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui.js:80
> +        if (tab.parentNode != this)

I'm sure this is obvious to you (and maybe to others?), but I don't understand why this check is need/what it is doing.

Maybe you could add a comment about that (and commit it).

If it is totally obvious, feel free to just add something in the bug and cq+ this.

Comment 3 Adam Barth 2011-10-09 19:11:53 PDT

getElementById is a global function.  It could return a DOM node anywhere in the document (which could have been put their by an attacker).  That check just restricts it to the immediate children of this node, which greatly limits any trickery.

Comment 4 Adam Barth 2011-10-09 19:14:24 PDT

Created attachment 110317 [details]
Patch for landing

Comment 5 WebKit Review Bot 2011-10-09 19:28:09 PDT

Comment on attachment 110317 [details]
Patch for landing

Clearing flags on attachment: 110317

Committed r97036: <http://trac.webkit.org/changeset/97036>

Comment 6 WebKit Review Bot 2011-10-09 19:28:14 PDT

All reviewed patches have been landed.  Closing bug.