Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(425)

Issue 1187843005: XSSAuditor: Dont give a pass to subsequent script blocks if first one is empty. (Closed)

Created:
5 years, 6 months ago by Tom Sepez
Modified:
5 years, 6 months ago
Reviewers:
Mike West
CC:
blink-reviews, blink-reviews-html_chromium.org, dglazkov+blink
Target Ref:
refs/heads/master
Project:
blink
Visibility:
Public.

Description

XSSAuditor: Dont give a pass to subsequent script blocks if first one is empty. Script bodies are filtered in chunks with the earliest chunk controlling the suppression of subsequent ones. But we may fail to match if the first chunk can be reduced to an empty string. Keep looking in that case. BUG=500877 Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=197282

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+13 lines, -6 lines) Patch
A + LayoutTests/http/tests/security/xssAuditor/script-tag-inside-svg-tag4.html View 1 chunk +2 lines, -1 line 0 comments Download
A LayoutTests/http/tests/security/xssAuditor/script-tag-inside-svg-tag4-expected.txt View 1 chunk +3 lines, -0 lines 0 comments Download
M Source/core/html/parser/XSSAuditor.cpp View 1 chunk +8 lines, -5 lines 0 comments Download

Messages

Total messages: 10 (4 generated)
Tom Sepez
Mike, for review. Legitimate bypass.
5 years, 6 months ago (2015-06-16 18:21:55 UTC) #2
Mike West
Makes sense to me, thanks for adding the test. LGTM.
5 years, 6 months ago (2015-06-17 08:49:42 UTC) #3
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1187843005/1
5 years, 6 months ago (2015-06-17 17:38:21 UTC) #5
commit-bot: I haz the power
Try jobs failed on following builders: win_blink_rel on tryserver.blink (JOB_FAILED, http://build.chromium.org/p/tryserver.blink/builders/win_blink_rel/builds/67057)
5 years, 6 months ago (2015-06-17 18:20:52 UTC) #7
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1187843005/1
5 years, 6 months ago (2015-06-17 19:19:06 UTC) #9
commit-bot: I haz the power
5 years, 6 months ago (2015-06-17 21:30:25 UTC) #10
Message was sent while issue was closed.
Committed patchset #1 (id:1) as
https://src.chromium.org/viewvc/blink?view=rev&revision=197282

Powered by Google App Engine
This is Rietveld 408576698