RESOLVED FIXED 72373
Web Inspector: inspector follows javascript: hrefs as relative 
https://bugs.webkit.org/show_bug.cgi?id=72373
Summary Web Inspector: inspector follows javascript: hrefs as relative
Rosen Dash
Reported 2011-11-15 03:29:27 PST
This bug has been reported at http://crbug/99664 Have a document with this code snippet. <a href="javascript:alert('foo');">Test link</a> Inspect the link, click the href in the inspector, inspector follows the href as if it were relative (eg. example.com/javascript:alert('foo');)
Attachments
Patch (4.86 KB, patch)
2011-11-15 08:21 PST, Alexander Pavlov (apavlov) 		no flags
DetailsFormatted DiffDiff
Patch (7.06 KB, patch)
2011-11-16 06:45 PST, Alexander Pavlov (apavlov) 		yurys: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Alexander Pavlov (apavlov)
Comment 1 2011-11-15 08:21:21 PST
Created attachment 115170 [details] Patch
Timothy Hatcher
Comment 2 2011-11-15 09:31:17 PST
Comment on attachment 115170 [details] Patch Should we prevent running the script in the Inspector? It seems we should send the script to the inspected page to exec.
Alexander Pavlov (apavlov)
Comment 3 2011-11-16 06:45:00 PST
Created attachment 115372 [details] Patch
Alexander Pavlov (apavlov)
Comment 4 2011-11-16 06:53:54 PST
(In reply to comment #2) > (From update of attachment 115170 [details]) > Should we prevent running the script in the Inspector? It seems we should send the script to the inspected page to exec. Right, running the code in the Inspector would be a huge security hole. We decided not to linkify the "javascript:..." URLs altogether.
Yury Semikhatsky
Comment 5 2011-11-16 07:40:32 PST
Comment on attachment 115372 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=115372&action=review > Source/WebCore/inspector/front-end/ResourceUtils.js:291 > + if (href.indexOf("javascript:") === 0) I'd rather do this check at the call site and return href here, otherwise looks good.
Alexander Pavlov (apavlov)
Comment 6 2011-11-17 02:10:33 PST
Committed r100588: <http://trac.webkit.org/changeset/100588>
Note You need to log in before you can comment on or make changes to this bug.