Bug 94547 - XSSAuditor too tolerant of injected data: URLs from other "hostless" schemes.
Summary: XSSAuditor too tolerant of injected data: URLs from other "hostless" schemes.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-08-20 16:39 PDT by Thomas Sepez
Modified: 2012-08-20 19:11 PDT (History)
3 users (show)

See Also:

Attachments
Patch + test case. (6.03 KB, patch)
2012-08-20 16:48 PDT, Thomas Sepez 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Sepez 2012-08-20 16:39:21 PDT 
Originally reported by sasha zivojinovic at crbug.com/142636

XSSAuditor's isSameOrignRequest() gets tripped up when the main page is loaded from say file:/// (which has no host portion) and the injected payload is from data: (which has no host portion).
No risk of cookie theft from data: URLs, but can do nuisance things like navigate the top page.
Unclear whether there are really any protocols that need this protection.
Comment 1 Thomas Sepez 2012-08-20 16:48:11 PDT 
Created attachment 159561 [details]
Patch + test case.
Comment 2 Thomas Sepez 2012-08-20 16:51:00 PDT 
Changed the name of the function so that it doesn't say "same origin" whilst completely ignoring scheme and port.
Comment 3 Adam Barth 2012-08-20 16:51:31 PDT 
Comment on attachment 159561 [details]
Patch + test case.

Ok.  We added this to weed out some false positives, but they were all for URLs that had hosts, so this is probably fine.
Comment 4 WebKit Review Bot 2012-08-20 19:11:18 PDT 
Comment on attachment 159561 [details]
Patch + test case.

Clearing flags on attachment: 159561

Committed r126120: <http://trac.webkit.org/changeset/126120>
Comment 5 WebKit Review Bot 2012-08-20 19:11:22 PDT 
All reviewed patches have been landed.  Closing bug.