RESOLVED FIXED 29306
[XSSAuditor] Scripts with accented characters can bypass the XSSAuditor 
https://bugs.webkit.org/show_bug.cgi?id=29306
Summary [XSSAuditor] Scripts with accented characters can bypass the XSSAuditor
Daniel Bates
Reported 2009-09-16 12:27:17 PDT
XSSAuditor::decodeURL used the wrong length for the input string. When the input string was decoded, the decoded result was truncated. Hence, XSSAuditor was comparing the source code of the script to the truncated input parameters.
Attachments
Patch with test case (3.51 KB, patch)
2009-09-16 12:29 PDT, Daniel Bates 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Daniel Bates
Comment 1 2009-09-16 12:29:23 PDT
Created attachment 39656 [details] Patch with test case
Adam Barth
Comment 2 2009-09-16 22:44:04 PDT
Comment on attachment 39656 [details] Patch with test case I know Dan would want to land this himself, but I'ld like this to get into the nightly build we so can close the loop with the sla.ckers.org folks.
Adam Barth
Comment 3 2009-09-16 23:42:43 PDT
Comment on attachment 39656 [details] Patch with test case Rejecting patch 39656 from commit-queue. This patch will require manual commit. ['WebKitTools/Scripts/run-webkit-tests'] failed with exit code 1
Adam Barth
Comment 4 2009-09-16 23:45:30 PDT
Comment on attachment 39656 [details] Patch with test case Clearing flags on attachment: 39656 Committed r48458: <http://trac.webkit.org/changeset/48458>
Adam Barth
Comment 5 2009-09-16 23:45:38 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.