29511 – [XSSAuditor] Script source code that contains non-ASCII characters may bypass the XSSAuditor

Bug 29511 - [XSSAuditor] Script source code that contains non-ASCII characters may bypass the XSSAuditor

Summary: [XSSAuditor] Script source code that contains non-ASCII characters may bypass...

Status:	RESOLVED FIXED

Alias:	None

Product:	WebKit
Classification:	Unclassified
Component:	WebCore Misc. (show other bugs)
Version:	528+ (Nightly build)
Hardware:	All All

Importance:	P2 Normal
Assignee:	Nobody

URL:
Keywords:	XSSAuditor

Depends on:
Blocks:	29278
	Show dependency tree / graph

Reported:	2009-09-18 17:10 PDT by Daniel Bates
Modified:	2009-09-19 13:30 PDT (History)
CC List:	3 users (show)

See Also:

Attachments
Patch with test cases (6.98 KB, patch) 2009-09-18 17:12 PDT, Daniel Bates	no flags	Details \| Formatted Diff \| Diff
Patch with test cases (8.57 KB, patch) 2009-09-18 17:37 PDT, Daniel Bates	no flags	Details \| Formatted Diff \| Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Daniel Bates 2009-09-18 17:10:04 PDT

Script source code that contains non-ASCII characters may bypass the XSSAuditor.

For example:

http://eaea.sirdarckcat.net/xss.php?html_xss=%3Cimg+src=%220%22+onerror=%22/%80/;alert(document.domain)%22%3E

http://eaea.sirdarckcat.net/xss.php?html_xss=%3Cimg+src='%80'+onerror=%27alert(document.domain)%27

Comment 1 Daniel Bates 2009-09-18 17:12:43 PDT

Created attachment 39804 [details]
Patch with test cases

Comment 2 Daniel Bates 2009-09-18 17:37:44 PDT

Created attachment 39805 [details]
Patch with test cases

Added another test case: img-onerror-non-ASCII-char-default-encoding.html

Comment 3 Adam Barth 2009-09-18 22:50:47 PDT

Comment on attachment 39805 [details]
Patch with test cases

Thanks Dan.  This looks great.

Comment 4 Daniel Bates 2009-09-19 13:29:54 PDT

Comment on attachment 39805 [details]
Patch with test cases

Clearing flags on attachment: 39805

Committed r48564: <http://trac.webkit.org/changeset/48564>

Comment 5 Daniel Bates 2009-09-19 13:30:01 PDT

All reviewed patches have been landed.  Closing bug.