projects / profile / ivi / webkit-efl.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 5dd2cc4)
XSS Auditor bypass with U+2028/2029
authortsepez@chromium.org <tsepez@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 16 Feb 2012 20:30:09 +0000 (20:30 +0000)
committertsepez@chromium.org <tsepez@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 16 Feb 2012 20:30:09 +0000 (20:30 +0000)
https://bugs.webkit.org/show_bug.cgi?id=78732

Reviewed by Adam Barth.

Source/WebCore:

Test: http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html

* html/parser/XSSAuditor.cpp:
(WebCore::isJSNewline):
(WebCore::XSSAuditor::snippetForJavaScript):

LayoutTests:

* http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028-expected.txt: Added.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@107967 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/html/parser/XSSAuditor.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index babfaa2..2f9d6f3 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2012-02-16  Tom Sepez  <tsepez@chromium.org>
+
+        XSS Auditor bypass with U+2028/2029
+        https://bugs.webkit.org/show_bug.cgi?id=78732
+
+        Reviewed by Adam Barth.
+
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028-expected.txt: Added.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html: Added.
+
 2012-02-16  Abhishek Arya  <inferno@chromium.org>
 
         Fix clone() function to handle descendant classes of RenderBlock.
diff --git a/LayoutTests/http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028-expected.txt b/LayoutTests/http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028-expected.txt
new file mode 100644 (file)
index 0000000..f0ecf3d
--- /dev/null
+++ b/LayoutTests/http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028-expected.txt
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: Refused to execute a JavaScript script. Source code of script found within request.
+
+
diff --git a/LayoutTests/http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html b/LayoutTests/http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html
new file mode 100644 (file)
index 0000000..1d5783e
--- /dev/null
+++ b/LayoutTests/http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+  layoutTestController.dumpAsText();
+  layoutTestController.setXSSAuditorEnabled(true);
+}
+</script>
+</head>
+<body>
+<iframe src="http://localhost:8000/security/xssAuditor/resources/echo-intertag.pl?q=<script>//%e2%80%a8alert(String.fromCharCode(0x58,0x53,0x53))</script>">
+</iframe>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 381af7b..f2ef580 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2012-02-16  Tom Sepez  <tsepez@chromium.org>
+
+        XSS Auditor bypass with U+2028/2029
+        https://bugs.webkit.org/show_bug.cgi?id=78732
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::isJSNewline):
+        (WebCore::XSSAuditor::snippetForJavaScript):
+
 2012-02-15  Mark Rowe  <mrowe@apple.com>
 
         NPN_GetValueForURL / NPNURLVProxy returns DIRECT when proxy configured via PAC
diff --git a/Source/WebCore/html/parser/XSSAuditor.cpp b/Source/WebCore/html/parser/XSSAuditor.cpp
index 138a671..e67e9f9 100644 (file)
--- a/Source/WebCore/html/parser/XSSAuditor.cpp
+++ b/Source/WebCore/html/parser/XSSAuditor.cpp
@@ -81,9 +81,10 @@ static bool isHTMLQuote(UChar c)
     return (c == '"' || c == '\'');
 }
 
-static bool isHTMLNewline(UChar c)
+static bool isJSNewline(UChar c)
 {
-    return (c == '\n' || c == '\r');
+    // Per ecma-262 section 7.3 Line Terminators.
+    return (c == '\n' || c == '\r' || c == 0x2028 || c == 0x2029);
 }
 
 static bool startsHTMLEndTagAt(const String& string, size_t start)
@@ -603,7 +604,7 @@ String XSSAuditor::snippetForJavaScript(const String& string)
         while (startPosition < endPosition && isHTMLSpace(string[startPosition]))
             startPosition++;
         if (startsHTMLCommentAt(string, startPosition) || startsSingleLineCommentAt(string, startPosition)) {
-            while (startPosition < endPosition && !isHTMLNewline(string[startPosition]))
+            while (startPosition < endPosition && !isJSNewline(string[startPosition]))
                 startPosition++;
         } else if (startsMultiLineCommentAt(string, startPosition)) {
             if ((foundPosition = string.find("*/", startPosition)) != notFound)
Domain: Web Framework / Uncategorized;