Source/core/html/parser/XSSAuditor.h - Issue 337143004: Fix XSSAuditor handling of semicolon-separated attributes.

Side by Side Diff: Source/core/html/parser/XSSAuditor.h

Issue 337143004: Fix XSSAuditor handling of semicolon-separated attributes. (Closed) Base URL: svn://svn.chromium.org/blink/trunk

Patch Set: Restore lost FIXME comment. Created 6 years, 6 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

« no previous file with comments | « LayoutTests/http/tests/security/xssAuditor/svg-animate-clutter-expected.txt ('k') | Source/core/html/parser/XSSAuditor.cpp » ('j') | Source/core/html/parser/XSSAuditor.cpp » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
1 /*	1 /*

2 * Copyright (C) 2011 Adam Barth. All Rights Reserved.	2 * Copyright (C) 2011 Adam Barth. All Rights Reserved.

3 *	3 *

4 * Redistribution and use in source and binary forms, with or without	4 * Redistribution and use in source and binary forms, with or without

5 * modification, are permitted provided that the following conditions	5 * modification, are permitted provided that the following conditions

6 * are met:	6 * are met:

7 * 1. Redistributions of source code must retain the above copyright	7 * 1. Redistributions of source code must retain the above copyright

8 * notice, this list of conditions and the following disclaimer.	8 * notice, this list of conditions and the following disclaimer.

9 * 2. Redistributions in binary form must reproduce the above copyright	9 * 2. Redistributions in binary form must reproduce the above copyright

10 * notice, this list of conditions and the following disclaimer in the	10 * notice, this list of conditions and the following disclaimer in the

(...skipping 85 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
96 bool filterBaseToken(const FilterTokenRequest&);	96 bool filterBaseToken(const FilterTokenRequest&);

97 bool filterFormToken(const FilterTokenRequest&);	97 bool filterFormToken(const FilterTokenRequest&);

98 bool filterInputToken(const FilterTokenRequest&);	98 bool filterInputToken(const FilterTokenRequest&);

99 bool filterButtonToken(const FilterTokenRequest&);	99 bool filterButtonToken(const FilterTokenRequest&);

100	100

101 bool eraseDangerousAttributesIfInjected(const FilterTokenRequest&);	101 bool eraseDangerousAttributesIfInjected(const FilterTokenRequest&);

102 bool eraseAttributeIfInjected(const FilterTokenRequest&, const QualifiedName &, const String& replacementValue = String(), TruncationKind treatment = NormalA ttributeTruncation);	102 bool eraseAttributeIfInjected(const FilterTokenRequest&, const QualifiedName &, const String& replacementValue = String(), TruncationKind treatment = NormalA ttributeTruncation);

103	103

104 String canonicalizedSnippetForTagName(const FilterTokenRequest&);	104 String canonicalizedSnippetForTagName(const FilterTokenRequest&);

105 String canonicalizedSnippetForJavaScript(const FilterTokenRequest&);	105 String canonicalizedSnippetForJavaScript(const FilterTokenRequest&);

	106 String nameFromAttribute(const FilterTokenRequest&, const HTMLToken::Attribu te&);

106 String snippetFromAttribute(const FilterTokenRequest&, const HTMLToken::Attr ibute&);	107 String snippetFromAttribute(const FilterTokenRequest&, const HTMLToken::Attr ibute&);

107 String canonicalize(String, TruncationKind);	108 String canonicalize(String, TruncationKind);

108	109

109 bool isContainedInRequest(const String&);	110 bool isContainedInRequest(const String&);

110 bool isLikelySafeResource(const String& url);	111 bool isLikelySafeResource(const String& url);

111	112

112 KURL m_documentURL;	113 KURL m_documentURL;

113 bool m_isEnabled;	114 bool m_isEnabled;

114	115

115 ReflectedXSSDisposition m_xssProtection;	116 ReflectedXSSDisposition m_xssProtection;

116 bool m_didSendValidCSPHeader;	117 bool m_didSendValidCSPHeader;

117 bool m_didSendValidXSSProtectionHeader;	118 bool m_didSendValidXSSProtectionHeader;

118	119

119 String m_decodedURL;	120 String m_decodedURL;

120 String m_decodedHTTPBody;	121 String m_decodedHTTPBody;

121 String m_httpBodyAsString;	122 String m_httpBodyAsString;

122 OwnPtr<SuffixTree<ASCIICodebook> > m_decodedHTTPBodySuffixTree;	123 OwnPtr<SuffixTree<ASCIICodebook> > m_decodedHTTPBodySuffixTree;

123	124

124 State m_state;	125 State m_state;

125 bool m_scriptTagFoundInRequest;	126 bool m_scriptTagFoundInRequest;

126 unsigned m_scriptTagNestingLevel;	127 unsigned m_scriptTagNestingLevel;

127 WTF::TextEncoding m_encoding;	128 WTF::TextEncoding m_encoding;

128 };	129 };

129	130

130 }	131 }

131	132

132 #endif	133 #endif

OLD	NEW