Chromium Code Reviews
DescriptionXSSAuditor takes post body from current request, not the original request.
In the face of a redirect, the information in the original body can't be
reflected in the final page, when we redirect from post to get, since the
get has no body. And for a 307-style redirect from post to post, the body
will appear in the final post.
This avoids some false positives and also the possibility of some info
leaks from the original post.
BUG=331725
R=abarth@chromium.org
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=164749
Patch Set 1 #Patch Set 2 : re-upload following branch #
Messages
Total messages: 4 (0 generated)
|
||||||||||||||||||||||||||||||||||||||||||||||