Highlight relfected XSS vectors in view-source page.

Source/core/html/HTMLViewSourceDocument.cpp

 /*
  * Copyright (C) 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 29 matching lines @@
 #include "core/html/HTMLTableElement.h"
 #include "core/html/HTMLTableRowElement.h"
 #include "core/html/HTMLTableSectionElement.h"
 #include "core/html/parser/HTMLToken.h"
 #include "core/html/parser/HTMLViewSourceParser.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
+namespace {
+
+const char kXSSDetected[] = "Token contains a reflected XSS vector";
+
+} // namespace
+
 HTMLViewSourceDocument::HTMLViewSourceDocument(const DocumentInit& initializer, const String& mimeType)
     : HTMLDocument(initializer)
     , m_type(mimeType)
 {
     setIsViewSource(true);
 
     // FIXME: Why do view-source pages need to load in quirks mode?
     setCompatibilityMode(QuirksMode);
     lockCompatibilityMode();
 }
@@ skipping 19 matching lines @@
     body->parserAppendChild(div);
 
     RefPtrWillBeRawPtr<HTMLTableElement> table = HTMLTableElement::create(*this);
     body->parserAppendChild(table);
     m_tbody = HTMLTableSectionElement::create(tbodyTag, *this);
     table->parserAppendChild(m_tbody);
     m_current = m_tbody;
     m_lineNumber = 0;
 }
 
-void HTMLViewSourceDocument::addSource(const String& source, HTMLToken& token)
+void HTMLViewSourceDocument::addSource(const String& source, HTMLToken& token, SourceAnnotation annotation)
 {
     if (!m_current)
         createContainingTable();
 
     switch (token.type()) {
     case HTMLToken::Uninitialized:
         ASSERT_NOT_REACHED();
         break;
     case HTMLToken::DOCTYPE:
         processDoctypeToken(source, token);
         break;
     case HTMLToken::EndOfFile:
         processEndOfFileToken(source, token);
         break;
     case HTMLToken::StartTag:
     case HTMLToken::EndTag:
-        processTagToken(source, token);
+        processTagToken(source, token, annotation);
         break;
     case HTMLToken::Comment:
         processCommentToken(source, token);
         break;
     case HTMLToken::Character:
-        processCharacterToken(source, token);
+        processCharacterToken(source, token, annotation);
         break;
     }
 }
 
 void HTMLViewSourceDocument::processDoctypeToken(const String& source, HTMLToken&)
 {
     m_current = addSpanWithClassName("webkit-html-doctype");
     addText(source, "webkit-html-doctype");
     m_current = m_td;
 }
 
 void HTMLViewSourceDocument::processEndOfFileToken(const String& source, HTMLToken&)
 {
     m_current = addSpanWithClassName("webkit-html-end-of-file");
     addText(source, "webkit-html-end-of-file");
     m_current = m_td;
 }
 
-void HTMLViewSourceDocument::processTagToken(const String& source, HTMLToken& token)
+void HTMLViewSourceDocument::processTagToken(const String& source, HTMLToken& token, SourceAnnotation annotation)
 {
+    maybeAddSpanForAnnotation(annotation);
     m_current = addSpanWithClassName("webkit-html-tag");
 
     AtomicString tagName(token.name());
 
     unsigned index = 0;
     HTMLToken::AttributeList::const_iterator iter = token.attributes().begin();
     while (index < source.length()) {
         if (iter == token.attributes().end()) {
             // We want to show the remaining characters in the token.
             index = addRange(source, index, source.length(), emptyAtom);
@@ skipping 20 matching lines @@
     m_current = m_td;
 }
 
 void HTMLViewSourceDocument::processCommentToken(const String& source, HTMLToken&)
 {
     m_current = addSpanWithClassName("webkit-html-comment");
     addText(source, "webkit-html-comment");
     m_current = m_td;
 }
 
-void HTMLViewSourceDocument::processCharacterToken(const String& source, HTMLToken&)
+void HTMLViewSourceDocument::processCharacterToken(const String& source, HTMLToken&, SourceAnnotation annotation)
 {
-    addText(source, "");
+    addText(source, "", annotation);
 }
 
 PassRefPtrWillBeRawPtr<Element> HTMLViewSourceDocument::addSpanWithClassName(const AtomicString& className)
 {
     if (m_current == m_tbody) {
         addLine(className);
         return m_current;
     }
 
     RefPtrWillBeRawPtr<HTMLSpanElement> span = HTMLSpanElement::create(*this);
@@ skipping 30 matching lines @@
 
 void HTMLViewSourceDocument::finishLine()
 {
     if (!m_current->hasChildren()) {
         RefPtrWillBeRawPtr<HTMLBRElement> br = HTMLBRElement::create(*this);
         m_current->parserAppendChild(br);
     }
     m_current = m_tbody;
 }
 
-void HTMLViewSourceDocument::addText(const String& text, const AtomicString& className)
+void HTMLViewSourceDocument::addText(const String& text, const AtomicString& className, SourceAnnotation annotation)
 {
     if (text.isEmpty())
         return;
 
     // Add in the content, splitting on newlines.
     Vector<String> lines;
     text.split('\n', true, lines);
     unsigned size = lines.size();
     for (unsigned i = 0; i < size; i++) {
         String substring = lines[i];
         if (m_current == m_tbody)
             addLine(className);
         if (substring.isEmpty()) {
             if (i == size - 1)
                 break;
             finishLine();
             continue;
         }
+        RefPtrWillBeRawPtr<Element> oldElement = m_current;
+        maybeAddSpanForAnnotation(annotation);
         m_current->parserAppendChild(Text::create(*this, substring));
+        m_current = oldElement;
         if (i < size - 1)
             finishLine();
     }
 }
 
 int HTMLViewSourceDocument::addRange(const String& source, int start, int end, const AtomicString& className, bool isLink, bool isAnchor, const AtomicString& link)
 {
     ASSERT(start <= end);
     if (start == end)
         return start;
@@ skipping 31 matching lines @@
         classValue = "webkit-html-attribute-value webkit-html-external-link";
     else
         classValue = "webkit-html-attribute-value webkit-html-resource-link";
     anchor->setAttribute(classAttr, classValue);
     anchor->setAttribute(targetAttr, "_blank");
     anchor->setAttribute(hrefAttr, url);
     m_current->parserAppendChild(anchor);
     return anchor.release();
 }
 
+void HTMLViewSourceDocument::maybeAddSpanForAnnotation(SourceAnnotation annotation)
+{
+    if (annotation == AnnotateSourceAsXSS) {
+        m_current = addSpanWithClassName("webkit-highlight");
+        m_current->setAttribute(titleAttr, kXSSDetected);
+    }
+}
+
 void HTMLViewSourceDocument::trace(Visitor* visitor)
 {
     visitor->trace(m_current);
     visitor->trace(m_tbody);
     visitor->trace(m_td);
     HTMLDocument::trace(visitor);
 }
 
 }