Bug 72373

Summary: Web Inspector: inspector follows javascript: hrefs as relative
Product: WebKit Reporter: Rosen Dash <rosen.dash>
Component: Web Inspector (Deprecated)Assignee: Alexander Pavlov (apavlov) <apavlov>
Status: RESOLVED FIXED    
Severity: Normal CC: apavlov, bweinstein, joepeck, keishi, loislo, pfeldman, pmuellr, rik, timothy, yurys
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
URL: http://dedimine.com/public/crbug-inspector-uri.html
Attachments:
Description Flags
Patch
none
Patch yurys: review+

Description Rosen Dash 2011-11-15 03:29:27 PST
This bug has been reported at http://crbug/99664

Have a document with this code snippet.
<a href="javascript:alert('foo');">Test link</a>

Inspect the link, click the href in the inspector, inspector follows the href as if it were relative (eg. example.com/javascript:alert('foo');)
Comment 1 Alexander Pavlov (apavlov) 2011-11-15 08:21:21 PST
Created attachment 115170 [details]
Patch
Comment 2 Timothy Hatcher 2011-11-15 09:31:17 PST
Comment on attachment 115170 [details]
Patch

Should we prevent running the script in the Inspector? It seems we should send the script to the inspected page to exec.
Comment 3 Alexander Pavlov (apavlov) 2011-11-16 06:45:00 PST
Created attachment 115372 [details]
Patch
Comment 4 Alexander Pavlov (apavlov) 2011-11-16 06:53:54 PST
(In reply to comment #2)
> (From update of attachment 115170 [details])
> Should we prevent running the script in the Inspector? It seems we should send the script to the inspected page to exec.

Right, running the code in the Inspector would be a huge security hole. We decided not to linkify the "javascript:..." URLs altogether.
Comment 5 Yury Semikhatsky 2011-11-16 07:40:32 PST
Comment on attachment 115372 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=115372&action=review

> Source/WebCore/inspector/front-end/ResourceUtils.js:291
> +        if (href.indexOf("javascript:") === 0)

I'd rather do this check at the call site and return href here, otherwise looks good.
Comment 6 Alexander Pavlov (apavlov) 2011-11-17 02:10:33 PST
Committed r100588: <http://trac.webkit.org/changeset/100588>