Bug 72373

Summary:

Web Inspector: inspector follows javascript: hrefs as relative

Product:

WebKit

Reporter:

Rosen Dash <rosen.dash>

Component:

Web Inspector (Deprecated)

Assignee:

Alexander Pavlov (apavlov) <apavlov>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

apavlov, bweinstein, joepeck, keishi, loislo, pfeldman, pmuellr, rik, timothy, yurys

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

URL:

http://dedimine.com/public/crbug-inspector-uri.html

Attachments:

Description	Flags
Patch	none
Patch	yurys: review+

Rosen Dash

Reported 2011-11-15 03:29:27 PST

This bug has been reported at http://crbug/99664 Have a document with this code snippet. <a href="javascript:alert('foo');">Test link</a> Inspect the link, click the href in the inspector, inspector follows the href as if it were relative (eg. example.com/javascript:alert('foo');)

Attachments
Patch (4.86 KB, patch) 2011-11-15 08:21 PST, Alexander Pavlov (apavlov)	no flags	Details Formatted Diff Diff
Patch (7.06 KB, patch) 2011-11-16 06:45 PST, Alexander Pavlov (apavlov)	yurys: review+	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.

Alexander Pavlov (apavlov)

Comment 1 2011-11-15 08:21:21 PST

Created attachment 115170 [details] Patch

Timothy Hatcher

Comment 2 2011-11-15 09:31:17 PST

Comment on attachment 115170 [details] Patch Should we prevent running the script in the Inspector? It seems we should send the script to the inspected page to exec.

Alexander Pavlov (apavlov)

Comment 3 2011-11-16 06:45:00 PST

Created attachment 115372 [details] Patch

Alexander Pavlov (apavlov)

Comment 4 2011-11-16 06:53:54 PST

(In reply to comment #2) > (From update of attachment 115170 [details]) > Should we prevent running the script in the Inspector? It seems we should send the script to the inspected page to exec. Right, running the code in the Inspector would be a huge security hole. We decided not to linkify the "javascript:..." URLs altogether.

Yury Semikhatsky

Comment 5 2011-11-16 07:40:32 PST

Comment on attachment 115372 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=115372&action=review > Source/WebCore/inspector/front-end/ResourceUtils.js:291 > + if (href.indexOf("javascript:") === 0) I'd rather do this check at the call site and return href here, otherwise looks good.

Alexander Pavlov (apavlov)

Comment 6 2011-11-17 02:10:33 PST

Committed r100588: <http://trac.webkit.org/changeset/100588>

Note You need to log in before you can comment on or make changes to this bug.