Bug 189551 - XSS auditor breaks srcdoc example in live-dom-viewer
Summary: XSS auditor breaks srcdoc example in live-dom-viewer
Status: RESOLVED DUPLICATE of bug 230499
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-09-12 09:32 PDT by Simon Fraser (smfr)
Modified: 2021-09-21 14:31 PDT (History)
6 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Sam Weinig 2018-09-12 18:05:29 PDT 
I'm pretty sure this isn't a parsing issue and is more likely the XSS Auditor kicking in. The same example renders fine in the Tryit Editor -> https://www.w3schools.com/code/tryit.asp?filename=FV8MYTW7FYTI.
Comment 2 Simon Fraser (smfr) 2018-09-12 18:21:51 PDT 
Ah yes, inspector says:

The XSS Auditor refused to execute a script in 'http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!DOCTYPE%20html%3E%0A%3Cstyle%3E%0Abody%20%7B%20background%3A%20aqua%20%7D%0A%3C%2Fstyle%3E%0A%3Ciframe%20srcdoc%3D%22%3Cdiv%20style%3Dbackground%3Ablue%3Bheight%3A30px%3E%3C%2Fdiv%3E%22%3E' because its source code was found within the request. The auditor was enabled because the server did not send an 'X-XSS-Protection' header.
Comment 3 Brent Fulgham 2021-09-21 14:31:39 PDT 
This is fixed when the XSS Auditor is removed (Bug 230499).

*** This bug has been marked as a duplicate of bug 230499 ***