Bug 30418 - [XSSAuditor] http://www.apple.com/startpage fails to render properly
Summary: [XSSAuditor] http://www.apple.com/startpage fails to render properly
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL: http://www.apple.com/startpage
Keywords: XSSAuditor
Depends on:
Blocks:
 
Reported: 2009-10-15 17:35 PDT by Daniel Bates
Modified: 2009-10-15 23:40 PDT (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Bates 2009-10-15 17:35:17 PDT 
The Apple start page fails to render properly because the XSSAuditor blocks loading content with respect to the specified HTML Base element. Notice the first seven characters of the src property of the HTML Base element is "http://" which is clearly in the page URL.
Comment 1 Adam Barth 2009-10-15 17:45:48 PDT 
Frown.  Let's revert the 7 character change while we think about these cases.
Comment 2 Daniel Bates 2009-10-15 17:54:45 PDT 
This issue also effects XSSAuditor::canLoadObject, and XSSAuditor::canEvaluateJavaScriptURL.
Comment 3 Adam Barth 2009-10-15 23:40:33 PDT 
Dan rolled out the offending patch.