Merge 86087 - 2011-05-09 Adam Barth <abarth@webkit.org>

Source/WebCore/html/parser/XSSFilter.cpp

 /*
  * Copyright (C) 2011 Adam Barth. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 25 matching lines @@
 #include "HTMLParserIdioms.h"
 #include "Settings.h"
 #include "TextEncoding.h"
 #include "TextResourceDecoder.h"
 #include <wtf/text/CString.h>
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-namespace {
-
-bool isNonCanonicalCharacter(UChar c)
+static bool isNonCanonicalCharacter(UChar c)
 {
     // We remove all non-ASCII characters, including non-printable ASCII characters.
     //
     // Note, we don't remove backslashes like PHP stripslashes(), which among other things converts "\\0" to the \0 character.
     // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the 
     // adverse effect that we remove any legitimate zeros from a string.
     //
     // For instance: new String("http://localhost:8000") => new String("http://localhost:8").
     return (c == '\\' || c == '0' || c == '\0' || c >= 127);
 }
 
-String canonicalize(const String& string)
+static String canonicalize(const String& string)
 {
     return string.removeCharacters(&isNonCanonicalCharacter);
 }
 
-bool isRequiredForInjection(UChar c)
+static bool isRequiredForInjection(UChar c)
 {
     return (c == '\'' || c == '"' || c == '<' || c == '>');
 }
 
-bool hasName(const HTMLToken& token, const QualifiedName& name)
+static bool hasName(const HTMLToken& token, const QualifiedName& name)
 {
     return equalIgnoringNullity(token.name(), static_cast<const String&>(name.localName()));
 }
 
-bool findAttributeWithName(const HTMLToken& token, const QualifiedName& name, size_t& indexOfMatchingAttribute)
+static bool findAttributeWithName(const HTMLToken& token, const QualifiedName& name, size_t& indexOfMatchingAttribute)
 {
     for (size_t i = 0; i < token.attributes().size(); ++i) {
         if (equalIgnoringNullity(token.attributes().at(i).m_name, name.localName())) {
             indexOfMatchingAttribute = i;
             return true;
         }
     }
     return false;
 }
 
-bool isNameOfInlineEventHandler(const Vector<UChar, 32>& name)
+static bool isNameOfInlineEventHandler(const Vector<UChar, 32>& name)
 {
     const size_t lengthOfShortestInlineEventHandlerName = 5; // To wit: oncut.
     if (name.size() < lengthOfShortestInlineEventHandlerName)
         return false;
     return name[0] == 'o' && name[1] == 'n';
 }
 
-bool containsJavaScriptURL(const Vector<UChar, 32>& value)
+static bool isDangerousHTTPEquiv(const String& value)
+{
+    String equiv = value.stripWhiteSpace();
+    return equalIgnoringCase(equiv, "refresh") || equalIgnoringCase(equiv, "set-cookie");
+}
+
+static bool containsJavaScriptURL(const Vector<UChar, 32>& value)
 {
     static const char javaScriptScheme[] = "javascript:";
     static const size_t lengthOfJavaScriptScheme = sizeof(javaScriptScheme) - 1;
 
     size_t i;
     for (i = 0; i < value.size(); ++i) {
         if (!isHTMLSpace(value[i]))
             break;
     }
 
     if (value.size() - i < lengthOfJavaScriptScheme)
         return false;
 
     return equalIgnoringCase(value.data() + i, javaScriptScheme, lengthOfJavaScriptScheme);
 }
 
-String decodeURL(const String& string, const TextEncoding& encoding)
+static String decodeURL(const String& string, const TextEncoding& encoding)
 {
     String workingString = string;
     workingString.replace('+', ' ');
     workingString = decodeURLEscapeSequences(workingString);
     CString workingStringUTF8 = workingString.utf8();
     String decodedString = encoding.decode(workingStringUTF8.data(), workingStringUTF8.length());
     // FIXME: Is this check necessary?
     if (decodedString.isEmpty())
         return canonicalize(workingString);
     return canonicalize(decodedString);
 }
 
-}
-
 XSSFilter::XSSFilter(HTMLDocumentParser* parser)
     : m_parser(parser)
     , m_isEnabled(false)
     , m_xssProtection(XSSProtectionEnabled)
     , m_state(Uninitialized)
 {
     ASSERT(m_parser);
     if (Frame* frame = parser->document()->frame()) {
         if (Settings* settings = frame->settings())
             m_isEnabled = settings->xssAuditorEnabled();
@@ skipping 277 matching lines @@
 }
 
 bool XSSFilter::eraseAttributeIfInjected(HTMLToken& token, const QualifiedName& attributeName, const String& replacementValue)
 {
     size_t indexOfAttribute;
     if (findAttributeWithName(token, attributeName, indexOfAttribute)) {
         const HTMLToken::Attribute& attribute = token.attributes().at(indexOfAttribute);
         if (isContainedInRequest(snippetForAttribute(token, attribute))) {
             if (attributeName == srcAttr && isSameOriginResource(String(attribute.m_value.data(), attribute.m_value.size())))
                 return false;
+            if (attributeName == http_equivAttr && !isDangerousHTTPEquiv(String(attribute.m_value.data(), attribute.m_value.size())))
+                return false;
             token.eraseValueOfAttribute(indexOfAttribute);
             if (!replacementValue.isEmpty())
                 token.appendToAttributeValue(indexOfAttribute, replacementValue);
             return true;
         }
     }
     return false;
 }
 
 String XSSFilter::snippetForRange(const HTMLToken& token, int start, int end)
@@ skipping 30 matching lines @@
     // probably not an XSS attack, so we reduce false positives by allowing the
     // request. If the resource has a query string, we're more suspicious,
     // however, because that's pretty rare and the attacker might be able to
     // trick a server-side script into doing something dangerous with the query
     // string.
     KURL resourceURL(m_parser->document()->url(), url);
     return (m_parser->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
 }
 
 }