Bug 130475 - XSS Auditor doesn't block <script> injected before an existing <script>
Summary: XSS Auditor doesn't block <script> injected before an existing <script>
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL: http://demofaast.elevenpaths.com:9002...
Keywords: InRadar, XSSAuditor
Depends on:
Blocks:
 
Reported: 2014-03-19 14:20 PDT by Daniel Bates
Modified: 2014-03-24 16:12 PDT (History)
4 users (show)

See Also:

Attachments
Layout tests (4.92 KB, patch)
2014-03-19 14:31 PDT, Daniel Bates 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Bates 2014-03-19 14:20:47 PDT 
Without loss of generality, consider a page with the following PHP markup:

<!DOCTYPE html>
<html>
<body>
<?php echo $_GET["q"] ?><script>function dummy() {}</script>
</body>
</html>

Take q := "<script>alert(/XSS/)". Then the page displays a JavaScript alert with message "/XSS/".
Comment 2 Daniel Bates 2014-03-19 14:21:22 PDT 
<rdar://problem/16348414>
Comment 3 Daniel Bates 2014-03-19 14:31:32 PDT 
Created attachment 227218 [details]
Layout tests

DRT layout tests. We may also want to supplement these tests with Thomas Sepez's tests in <https://codereview.chromium.org/205243002/>.
Comment 4 Daniel Bates 2014-03-19 14:38:15 PDT 
(In reply to comment #3)
> Created an attachment (id=227218) [details]
> Layout tests
> 
> DRT layout tests. We may also want to supplement these tests with Thomas Sepez's tests in <https://codereview.chromium.org/205243002/>.

I should add that the contents of the included -expected.txt files need to be updated.
Comment 5 David Kilzer (:ddkilzer) 2014-03-22 19:11:14 PDT 
Fixed in Blink:  <http://src.chromium.org/viewvc/blink?view=rev&rev=169697>
Comment 6 Daniel Bates 2014-03-24 16:12:27 PDT 
Committed r166202: <http://trac.webkit.org/changeset/166202>