RESOLVED DUPLICATE of bug 230499 Bug 189551
XSS auditor breaks srcdoc example in live-dom-viewer 
https://bugs.webkit.org/show_bug.cgi?id=189551
Summary XSS auditor breaks srcdoc example in live-dom-viewer
Attachments
Add attachment proposed patch, testcase, etc.
Sam Weinig
Comment 1 2018-09-12 18:05:29 PDT
I'm pretty sure this isn't a parsing issue and is more likely the XSS Auditor kicking in. The same example renders fine in the Tryit Editor -> https://www.w3schools.com/code/tryit.asp?filename=FV8MYTW7FYTI.
Simon Fraser (smfr)
Comment 2 2018-09-12 18:21:51 PDT
Ah yes, inspector says: The XSS Auditor refused to execute a script in 'http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!DOCTYPE%20html%3E%0A%3Cstyle%3E%0Abody%20%7B%20background%3A%20aqua%20%7D%0A%3C%2Fstyle%3E%0A%3Ciframe%20srcdoc%3D%22%3Cdiv%20style%3Dbackground%3Ablue%3Bheight%3A30px%3E%3C%2Fdiv%3E%22%3E' because its source code was found within the request. The auditor was enabled because the server did not send an 'X-XSS-Protection' header.
Brent Fulgham
Comment 3 2021-09-21 14:31:39 PDT
This is fixed when the XSS Auditor is removed (Bug 230499). *** This bug has been marked as a duplicate of bug 230499 ***
Note You need to log in before you can comment on or make changes to this bug.