Bug 72373 - Web Inspector: inspector follows javascript: hrefs as relative
Summary: Web Inspector: inspector follows javascript: hrefs as relative
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Web Inspector (Deprecated) (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Alexander Pavlov (apavlov)
URL: http://dedimine.com/public/crbug-insp...
Keywords:
Depends on:
Blocks:
 
Reported: 2011-11-15 03:29 PST by Rosen Dash
Modified: 2011-11-17 02:10 PST (History)
10 users (show)

See Also:


Attachments
Patch (4.86 KB, patch)
2011-11-15 08:21 PST, Alexander Pavlov (apavlov)
no flags Details | Formatted Diff | Diff
Patch (7.06 KB, patch)
2011-11-16 06:45 PST, Alexander Pavlov (apavlov)
yurys: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Rosen Dash 2011-11-15 03:29:27 PST
This bug has been reported at http://crbug/99664

Have a document with this code snippet.
<a href="javascript:alert('foo');">Test link</a>

Inspect the link, click the href in the inspector, inspector follows the href as if it were relative (eg. example.com/javascript:alert('foo');)
Comment 1 Alexander Pavlov (apavlov) 2011-11-15 08:21:21 PST
Created attachment 115170 [details]
Patch
Comment 2 Timothy Hatcher 2011-11-15 09:31:17 PST
Comment on attachment 115170 [details]
Patch

Should we prevent running the script in the Inspector? It seems we should send the script to the inspected page to exec.
Comment 3 Alexander Pavlov (apavlov) 2011-11-16 06:45:00 PST
Created attachment 115372 [details]
Patch
Comment 4 Alexander Pavlov (apavlov) 2011-11-16 06:53:54 PST
(In reply to comment #2)
> (From update of attachment 115170 [details])
> Should we prevent running the script in the Inspector? It seems we should send the script to the inspected page to exec.

Right, running the code in the Inspector would be a huge security hole. We decided not to linkify the "javascript:..." URLs altogether.
Comment 5 Yury Semikhatsky 2011-11-16 07:40:32 PST
Comment on attachment 115372 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=115372&action=review

> Source/WebCore/inspector/front-end/ResourceUtils.js:291
> +        if (href.indexOf("javascript:") === 0)

I'd rather do this check at the call site and return href here, otherwise looks good.
Comment 6 Alexander Pavlov (apavlov) 2011-11-17 02:10:33 PST
Committed r100588: <http://trac.webkit.org/changeset/100588>