Skip to content

GitLab

T
tangled
Commit f4902b85 authored by abarth@webkit.org's avatar abarth@webkit.org
Browse files
Options

2010-01-28 Adam Barth <abarth@webkit.org> 

        Reviewed by David Levin.

        Remove XSSAuditor false positive for Google Translate
        https://bugs.webkit.org/show_bug.cgi?id=34242

        Add a test that we allow attackers to inject directly into the href
        property of the base tag.

        * http/tests/security/xssAuditor/base-href-direct-expected.txt: Added.
        * http/tests/security/xssAuditor/base-href-direct.html: Added.
        * http/tests/security/xssAuditor/resources/echo-head-base-href-direct.pl: Added.
2010-01-28  Adam Barth  <abarth@webkit.org>

        Reviewed by David Levin.

        Remove XSSAuditor false positive for Google Translate
        https://bugs.webkit.org/show_bug.cgi?id=34242

        Google translate takes a base URL as a parameter, causing a false
        positive in the XSS filter.  This patch removes the false positive by
        allowing direct injections into the href property of the base tag.

        Test: http/tests/security/xssAuditor/base-href-direct.html

        * page/XSSAuditor.cpp:
        (WebCore::XSSAuditor::canSetBaseElementURL):

git-svn-id: svn://svn.chromium.org/blink/trunk@54010 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 715ee841
Hide whitespace changes
Inline Side-by-side
Showing with 68 additions and 0 deletions
third_party/WebKit/LayoutTests/ChangeLog
View file @ f4902b85
2010-01-28 Adam Barth <abarth@webkit.org>
Reviewed by David Levin.
Remove XSSAuditor false positive for Google Translate
https://bugs.webkit.org/show_bug.cgi?id=34242
Add a test that we allow attackers to inject directly into the href
property of the base tag.
* http/tests/security/xssAuditor/base-href-direct-expected.txt: Added.
* http/tests/security/xssAuditor/base-href-direct.html: Added.
* http/tests/security/xssAuditor/resources/echo-head-base-href-direct.pl: Added.
2010-01-28 Simon Fraser <simon.fraser@apple.com> 2010-01-28 Simon Fraser <simon.fraser@apple.com>
Reviewed by Dan Bernstein. Reviewed by Dan Bernstein.
third_party/WebKit/LayoutTests/http/tests/security/xssAuditor/base-href-direct-expected.txt 0 → 100644
View file @ f4902b85
ALERT: /XSS/
We allow direct injections into base tags to reduce false positives.
third_party/WebKit/LayoutTests/http/tests/security/xssAuditor/base-href-direct.html 0 → 100644
View file @ f4902b85
<!DOCTYPE html>
<html>
<head>
<script>
if (window.layoutTestController) {
layoutTestController.dumpAsText();
layoutTestController.setXSSAuditorEnabled(true);
}
</script>
</head>
<body>
<p>We allow direct injections into base tags to reduce false positives.</p>
<iframe src="http://localhost:8000/security/xssAuditor/resources/echo-head-base-href-direct.pl?q=http://127.0.0.1:8000/security/xssAuditor/resources/base-href/">
</iframe>
</body>
</html>
third_party/WebKit/LayoutTests/http/tests/security/xssAuditor/resources/echo-head-base-href-direct.pl 0 → 100755
View file @ f4902b85
#!/usr/bin/perl -wT
use strict;
use CGI;
my $cgi = new CGI;
print "Content-Type: text/html; charset=UTF-8\n\n";
print "<!DOCTYPE html>\n";
print "<html>\n";
print "<head>\n";
print "<base href=\"".$cgi->param('q')."\">\n";
print "</head>\n";
print "<body>\n";
print "<script src='safe-script.js'></script>\n";
print "</body>\n";
print "</html>\n";
third_party/WebKit/WebCore/ChangeLog
View file @ f4902b85
2010-01-28 Adam Barth <abarth@webkit.org>
Reviewed by David Levin.
Remove XSSAuditor false positive for Google Translate
https://bugs.webkit.org/show_bug.cgi?id=34242
Google translate takes a base URL as a parameter, causing a false
positive in the XSS filter. This patch removes the false positive by
allowing direct injections into the href property of the base tag.
Test: http/tests/security/xssAuditor/base-href-direct.html
* page/XSSAuditor.cpp:
(WebCore::XSSAuditor::canSetBaseElementURL):
2010-01-28 Nikolas Zimmermann <nzimmermann@rim.com> 2010-01-28 Nikolas Zimmermann <nzimmermann@rim.com>
Reviewed by Dirk Schulze. Reviewed by Dirk Schulze.
third_party/WebKit/WebCore/page/XSSAuditor.cpp
View file @ f4902b85
...@@ -202,6 +202,7 @@ bool XSSAuditor::canSetBaseElementURL(const String& url) const ...@@ -202,6 +202,7 @@ bool XSSAuditor::canSetBaseElementURL(const String& url) const
FindTask task; FindTask task;
task.string = url; task.string = url;
task.allowRequestIfNoIllegalURICharacters = true;
if (findInRequest(task)) { if (findInRequest(task)) {
DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to load from document base URL. URL found within request.\n")); DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to load from document base URL. URL found within request.\n"));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment