XSSAuditor bypass with frameset tags.

Source/core/html/parser/XSSAuditor.cpp

 /*
  * Copyright (C) 2011 Adam Barth. All Rights Reserved.
  * Copyright (C) 2011 Daniel Bates (dbates@intudata.com).
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 335 matching lines @@
         ASSERT(request.shouldAllowCDATA || !m_scriptTagNestingLevel);
         m_scriptTagNestingLevel++;
     } else if (hasName(request.token, objectTag))
         didBlockScript |= filterObjectToken(request);
     else if (hasName(request.token, paramTag))
         didBlockScript |= filterParamToken(request);
     else if (hasName(request.token, embedTag))
         didBlockScript |= filterEmbedToken(request);
     else if (hasName(request.token, appletTag))
         didBlockScript |= filterAppletToken(request);
-    else if (hasName(request.token, iframeTag))
+    else if (hasName(request.token, iframeTag) || hasName(request.token, frameTag))
         didBlockScript |= filterIframeToken(request);

[abarth-chromium, 2013/09/13 21:19:51]

filterIframeToken -> Can we rename this function to filterFrameToken ?

[Tom Sepez, 2013/09/13 21:29:28]

Done.

     else if (hasName(request.token, metaTag))
         didBlockScript |= filterMetaToken(request);
     else if (hasName(request.token, baseTag))
         didBlockScript |= filterBaseToken(request);
     else if (hasName(request.token, formTag))
         didBlockScript |= filterFormToken(request);
     else if (hasName(request.token, inputTag))
         didBlockScript |= filterInputToken(request);
     else if (hasName(request.token, buttonTag))
         didBlockScript |= filterButtonToken(request);
@@ skipping 88 matching lines @@
     if (isContainedInRequest(decodedSnippetForName(request))) {
         didBlockScript |= eraseAttributeIfInjected(request, codeAttr, String(), SrcLikeAttribute);
         didBlockScript |= eraseAttributeIfInjected(request, objectAttr);
     }
     return didBlockScript;
 }
 
 bool XSSAuditor::filterIframeToken(const FilterTokenRequest& request)
 {
     ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, iframeTag));
+    ASSERT(hasName(request.token, iframeTag) || hasName(request.token, frameTag));
 
     bool didBlockScript = false;
     if (isContainedInRequest(decodedSnippetForName(request))) {
         didBlockScript |= eraseAttributeIfInjected(request, srcAttr, String(), SrcLikeAttribute);
         didBlockScript |= eraseAttributeIfInjected(request, srcdocAttr, String(), ScriptLikeAttribute);
     }
     return didBlockScript;
 }
 
 bool XSSAuditor::filterMetaToken(const FilterTokenRequest& request)
@@ skipping 239 matching lines @@
 }
 
 bool XSSAuditor::isSafeToSendToAnotherThread() const
 {
     return m_documentURL.isSafeToSendToAnotherThread()
         && m_decodedURL.isSafeToSendToAnotherThread()
         && m_decodedHTTPBody.isSafeToSendToAnotherThread();
 }
 
 } // namespace WebCore