[EFL] [DRT] LayoutTestController needs implementation of setXSSAuditorEnabled

• Component: WebKit EFL
• Status: RESOLVED DUPLICATE

[Sudarsana Nagineni (babu)]

LayoutTestController needs implementation of setXSSAuditorEnabled in order to unskip tests in http/tests/security/xssAuditor.

[Sudarsana Nagineni (babu)]

Created attachment 135607 [details]
Patch

DRT support for setXSSAuditorEnabled

[Raphael Kubo da Costa (:rakuco)]

Comment on attachment 135607 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=135607&action=review

> LayoutTests/platform/efl/Skipped:449
> +# EFL's LayoutTestController does not implement setCanOpenWindows and setCloseRemainingWindowsWhenComplete

These methods are implemented in LTC itself, not in the port's subclass.

> LayoutTests/platform/efl/Skipped:451
> +# EFL's LayoutTestController does not implement dumpFrameLoadCallbacks

You might want to coordinate with Christoph here, as he's working on unskipping tests related to this.

[Raphael Kubo da Costa (:rakuco)]

What does the XSS auditor do? Is it something that would be useful to expose publicly?

[Sudarsana Nagineni (babu)]

(In reply to comment #2)

Thanks for review.
> > LayoutTests/platform/efl/Skipped:449
> > +# EFL's LayoutTestController does not implement setCanOpenWindows and setCloseRemainingWindowsWhenComplete
> 
Okay. This test can be unskipped by enabling XSSAuditor by default when new window is opened.

> These methods are implemented in LTC itself, not in the port's subclass.
> 
> > LayoutTests/platform/efl/Skipped:451
> > +# EFL's LayoutTestController does not implement dumpFrameLoadCallbacks
> 
> You might want to coordinate with Christoph here, as he's working on unskipping tests related to this.

Chris patch doesn't fully fix this test. FrameLoaderClientEfl::didDetectXSS implementation also needed in order to unskip this test. I will update the description.

[Sudarsana Nagineni (babu)]

(In reply to comment #3)
> What does the XSS auditor do? 
It provides protection from reflected XSS attacks of malicious websites.

> Is it something that would be useful to expose publicly?
Yes, good to expose this pref to users. I will create a new bug and implement set/get APIs for this setting.

[Sudarsana Nagineni (babu)]

Created attachment 135878 [details]
Patch

Use ewk API to enable the setting

[Gyuyoung Kim]

Comment on attachment 135878 [details]
Patch

Attachment 135878 [details] did not pass efl-ews (efl):
Output: http://queues.webkit.org/results/12264454

[Gyuyoung Kim]

Comment on attachment 135878 [details]
Patch

Clearing r? flag because you should submit this patch again after landing a patch of Bug 83281

[Sudarsana Nagineni (babu)]

As mentioned in bug #83281 and discussed on #webkit-efl, implemented everything together in bug #83281.

*** This bug has been marked as a duplicate of bug 83281 ***