Emphasize that the XSS tests should not be casually suppressed

Emphasize that the XSS tests should not be casually suppressed

BUG=
R=terry@google.com

Committed: https://code.google.com/p/dart/source/detail?r=45117

[Alan Knight, 2015-04-10 17:10:41]

alanknight@google.com changed reviewers:
+ terry@google.com

[Alan Knight, 2015-04-10 17:10:42]

This is just a file rename with an additional comment at the beginning.

[terry, 2015-04-13 17:10:49]

LGTM just minor nits and not sure why some of the attributes should fail with
not valid (they seem valid).

https://codereview.chromium.org/1080583003/diff/1/tests/html/html.status
File tests/html/html.status (right):

https://codereview.chromium.org/1080583003/diff/1/tests/html/html.status#newc...
tests/html/html.status:57:
node_validator_important_if_you_suppress_make_the_bug_critical_test/dom_clobbering:
Skip # Dartium is immune to DOM clobbering, so the HTML passes through the
sanitizer.
Maybe add this comment with blank line before and after test so the test is an
island all by itself with an important comment:

# DO NOT Suppress/Skip the below XSS security test for dart2js - any failure is
a P0 bug.
node_validator_test/dom_clobbering: Skip # Dartium is immune to DOM clobbering,
so the HTML passes through the sanitizer.

https://codereview.chromium.org/1080583003/diff/1/tests/html/node_validator_t...
File tests/html/node_validator_test.dart (left):

https://codereview.chromium.org/1080583003/diff/1/tests/html/node_validator_t...
tests/html/node_validator_test.dart:452: document.body.createFragment('<img
src="http://example.com/foo.jpg"/>',
Why is this src atttribute not valid?

[Alan Knight, 2015-04-13 19:08:36]

https://codereview.chromium.org/1080583003/diff/1/tests/html/html.status
File tests/html/html.status (right):

https://codereview.chromium.org/1080583003/diff/1/tests/html/html.status#newc...
tests/html/html.status:57:
node_validator_important_if_you_suppress_make_the_bug_critical_test/dom_clobbering:
Skip # Dartium is immune to DOM clobbering, so the HTML passes through the
sanitizer.
On 2015/04/13 17:10:49, terry wrote:
> Maybe add this comment with blank line before and after test so the test is an
> island all by itself with an important comment:
> 
> # DO NOT Suppress/Skip the below XSS security test for dart2js - any failure
is
> a P0 bug.
> node_validator_test/dom_clobbering: Skip # Dartium is immune to DOM
clobbering,
> so the HTML passes through the sanitizer.
> 

Done. Also changed it to a Fail rather than Skip, so any future changes in
Dartium that left it vulnerable would be noticed.

https://codereview.chromium.org/1080583003/diff/1/tests/html/node_validator_t...
File tests/html/node_validator_test.dart (left):

https://codereview.chromium.org/1080583003/diff/1/tests/html/node_validator_t...
tests/html/node_validator_test.dart:452: document.body.createFragment('<img
src="http://example.com/foo.jpg"/>',
On 2015/04/13 17:10:49, terry wrote:
> Why is this src atttribute not valid?

Default validator uses SameOriginUriPolicy, so it fails because it specifies a
URL to another domain.

[Alan Knight, 2015-04-13 19:09:08]

Committed patchset #2 (id:20001) manually as 45117 (presubmit successful).