Bug 26580 - Fix to enable XSSAuditor on child windows
Summary: Fix to enable XSSAuditor on child windows
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Adam Barth
Depends on:
Reported: 2009-06-20 23:57 PDT by Daniel Bates
Modified: 2009-06-21 19:40 PDT (History)
2 users (show)

See Also:

Patch with a test (6.53 KB, patch)
2009-06-21 00:29 PDT, Daniel Bates
abarth: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Bates 2009-06-20 23:57:07 PDT
If XSSAuditor is enabled, then it is only enabled on windows explicitly instantiated by a user through File->New Window or File->New Tab. That is, windows instantiated through a link (i.e. have a target of "_blank") have XSSAuditor disabled.

The expected behavior is for XSSAuditor to be enabled on all windows regardless of how they were instantiated.
Comment 1 Daniel Bates 2009-06-21 00:29:09 PDT
Created attachment 31606 [details]
Patch with a test
Comment 2 Adam Barth 2009-06-21 00:48:53 PDT
Comment on attachment 31606 [details]
Patch with a test

Thanks Dan!  Below are some minor style nits.  I'll fix them before landing the patch.

> +XSSAuditor::XSSAuditor(Frame* frame) : m_frame(frame)

The ": m_frame" bit should be on the next line.

> +    layoutTestController.dumpChildFramesAsText();

The test doesn't create any child windows, so this call doesn't do anything.

> +    var event = document.createEvent('MouseEvent');
> +    event.initEvent('click', true, true);
> +    document.getElementById('anchorLink').dispatchEvent(event);

I think the anchor tag has a click() method that would be eaiser, but this does the job.

> +if (window.layoutTestController) {
> +  layoutTestController.notifyDone();
> +}

No braces needed for if statements with single-line bodies.
Comment 3 Adam Barth 2009-06-21 19:40:26 PDT
Sending        LayoutTests/ChangeLog
Adding         LayoutTests/http/tests/security/xssAuditor/link-opens-new-window-expected.txt
Adding         LayoutTests/http/tests/security/xssAuditor/link-opens-new-window.html
Adding         LayoutTests/http/tests/security/xssAuditor/resources/echo-intertag-and-notify.php
Sending        WebCore/ChangeLog
Sending        WebCore/page/XSSAuditor.cpp
Sending        WebCore/page/XSSAuditor.h
Transmitting file data .......
Committed revision 44927.