XSSAuditor bypass with leading /*///*/ comment

[Thomas Sepez]

Originally reported by k3170makan at http://code.google.com/p/chromium/issues/detail?id=130594

query string: ?name=%3Cscript%3E/*///*/alert(1);%3C/script%3E
reflected vector: <script>/*///*/alert(1);</script>

[Thomas Sepez]

Off by two.  The block:

else if (startsMultiLineCommentAt(string, startPosition)) {
            if ((foundPosition = string.find("*/", startPosition)) != notFound)
                startPosition = foundPosition + 2;

is matching /*/ as a complete comment, which it's not.  Then when we look at the next characters, we see // which we interpret as a single line comment -- but the JS parser doesn't.

[Thomas Sepez]

Created attachment 145144 [details]
patch/test

[Thomas Sepez]

Adam, please review.

[WebKit Review Bot]

Attachment 145144 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/http..." exit_code: 1
LayoutTests/ChangeLog:8:  Line contains tab character.  [whitespace/tab] [5]
LayoutTests/ChangeLog:9:  Line contains tab character.  [whitespace/tab] [5]
Source/WebCore/ChangeLog:8:  Line contains tab character.  [whitespace/tab] [5]
Total errors found: 3 in 5 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Thomas Sepez]

Created attachment 145147 [details]
patch/test/fix indent

[WebKit Review Bot]

Comment on attachment 145147 [details]
patch/test/fix indent

Clearing flags on attachment: 145147

Committed r119184: <http://trac.webkit.org/changeset/119184>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Andy Estes]

<rdar://problem/11652371>