<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[195260] releases/WebKitGTK/webkit-2.10</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/195260">195260</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-01-19 00:28:45 -0800 (Tue, 19 Jan 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/194978">r194978</a> - [XSS Auditor] Add test when XSS payload is in the path portion of the URL
https://bugs.webkit.org/show_bug.cgi?id=152871
Patch by Daniel Bates <dabates@apple.com> on 2016-01-13
Reviewed by Brent Fulgham.
Merged from Blink (patch by Tom Sepez <tsepez@chromium.org>):
<https://src.chromium.org/viewvc/blink?revision=164746&view=revision>
Tools:
* Scripts/webkitpy/layout_tests/servers/lighttpd.conf:
LayoutTests:
Add infrastructure and a test for an XSS attack where the payload is
embedded in the path portion of the URL.
Many XSS Auditor tests pass the XSS payload to CGI scripts via the
query string portion of the URL. Now we also support calling these
same scripts with the payload embedded in the path portion of the
URL.
Loading <http://127.0.0.1:8000/security/xssAuditor/intercept/X/Y>
returns a response whose content is identical to <http://127.0.0.1:8000/security/xssAuditor/resoures/X?q=Y>,
where X is the filename of some CGI script in directory LayoutTests/http/tests/security/xssAuditor/resources
and Y is the XSS payload.
* http/tests/security/xssAuditor/intercept/.htaccess: Added.
* http/tests/security/xssAuditor/reflection-in-path-expected.txt: Added.
* http/tests/security/xssAuditor/reflection-in-path.html: Added.
* http/tests/security/xssAuditor/resources/echo-form-action.pl: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit210LayoutTestsChangeLog">releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit210ToolsChangeLog">releases/WebKitGTK/webkit-2.10/Tools/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit210ToolsScriptswebkitpylayout_testsserverslighttpdconf">releases/WebKitGTK/webkit-2.10/Tools/Scripts/webkitpy/layout_tests/servers/lighttpd.conf</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li>releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/intercept/</li>
<li><a href="#releasesWebKitGTKwebkit210LayoutTestshttptestssecurityxssAuditorintercepthtaccess">releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/intercept/.htaccess</a></li>
<li><a href="#releasesWebKitGTKwebkit210LayoutTestshttptestssecurityxssAuditorreflectioninpathexpectedtxt">releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit210LayoutTestshttptestssecurityxssAuditorreflectioninpathhtml">releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path.html</a></li>
<li><a href="#releasesWebKitGTKwebkit210LayoutTestshttptestssecurityxssAuditorresourcesechoformactionpl">releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/resources/echo-form-action.pl</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit210LayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog (195259 => 195260)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 08:26:13 UTC (rev 195259)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 08:28:45 UTC (rev 195260)
</span><span class="lines">@@ -1,3 +1,31 @@
</span><ins>+2016-01-13 Daniel Bates <dabates@apple.com>
+
+ [XSS Auditor] Add test when XSS payload is in the path portion of the URL
+ https://bugs.webkit.org/show_bug.cgi?id=152871
+
+ Reviewed by Brent Fulgham.
+
+ Merged from Blink (patch by Tom Sepez <tsepez@chromium.org>):
+ <https://src.chromium.org/viewvc/blink?revision=164746&view=revision>
+
+ Add infrastructure and a test for an XSS attack where the payload is
+ embedded in the path portion of the URL.
+
+ Many XSS Auditor tests pass the XSS payload to CGI scripts via the
+ query string portion of the URL. Now we also support calling these
+ same scripts with the payload embedded in the path portion of the
+ URL.
+
+ Loading <http://127.0.0.1:8000/security/xssAuditor/intercept/X/Y>
+ returns a response whose content is identical to <http://127.0.0.1:8000/security/xssAuditor/resoures/X?q=Y>,
+ where X is the filename of some CGI script in directory LayoutTests/http/tests/security/xssAuditor/resources
+ and Y is the XSS payload.
+
+ * http/tests/security/xssAuditor/intercept/.htaccess: Added.
+ * http/tests/security/xssAuditor/reflection-in-path-expected.txt: Added.
+ * http/tests/security/xssAuditor/reflection-in-path.html: Added.
+ * http/tests/security/xssAuditor/resources/echo-form-action.pl: Added.
+
</ins><span class="cx"> 2016-01-12 Daniel Bates <dabates@apple.com>
</span><span class="cx">
</span><span class="cx"> XSS Auditor should navigate to empty substitute data on full page block
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210LayoutTestshttptestssecurityxssAuditorintercepthtaccess"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/intercept/.htaccess (0 => 195260)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/intercept/.htaccess (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/intercept/.htaccess 2016-01-19 08:28:45 UTC (rev 195260)
</span><span class="lines">@@ -0,0 +1,2 @@
</span><ins>+RewriteEngine on
+RewriteRule ^(.*)/(.*) /security/xssAuditor/resources/$1?q=$2 [L,NS]
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit210LayoutTestshttptestssecurityxssAuditorreflectioninpathexpectedtxt"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path-expected.txt (0 => 195260)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path-expected.txt 2016-01-19 08:28:45 UTC (rev 195260)
</span><span class="lines">@@ -0,0 +1,9 @@
</span><ins>+CONSOLE MESSAGE: line 5: The XSS Auditor refused to execute a script in 'http://localhost:8000/security/xssAuditor/intercept/echo-form-action.pl/%22%20onmouseover=%22JavaScript:alert(document.domain)%22%20name=%22?m=login' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.
+
+
+--------
+Frame: '<!--framePath //<!--frame0-->-->'
+--------
+This is an iframe with a injected form
+
+
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit210LayoutTestshttptestssecurityxssAuditorreflectioninpathhtml"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path.html (0 => 195260)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path.html (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/reflection-in-path.html 2016-01-19 08:28:45 UTC (rev 195260)
</span><span class="lines">@@ -0,0 +1,16 @@
</span><ins>+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.dumpChildFramesAsText();
+ testRunner.setXSSAuditorEnabled(true);
+ testRunner.waitUntilDone();
+}
+</script>
+</head>
+<body>
+<iframe src="http://localhost:8000/security/xssAuditor/intercept/echo-form-action.pl/%22%20onmouseover=%22JavaScript:alert(document.domain)%22%20name=%22?m=login"></iframe>
+</body>
+</html>
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit210LayoutTestshttptestssecurityxssAuditorresourcesechoformactionpl"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/resources/echo-form-action.pl (0 => 195260)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/resources/echo-form-action.pl (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/resources/echo-form-action.pl 2016-01-19 08:28:45 UTC (rev 195260)
</span><span class="lines">@@ -0,0 +1,16 @@
</span><ins>+#!/usr/bin/perl -wT
+use strict;
+use CGI;
+
+my $cgi = new CGI;
+
+print "Content-Type: text/html; charset=UTF-8\n\n";
+
+print "<!DOCTYPE html>\n";
+print "<html>\n";
+print "<body>\n";
+print "<p>This is an iframe with a injected form</p>\n";
+print "<form method=\"post\" id=\"login\" action=\"".$cgi->param('q')."\"></form>\n";
+print "<script>if (window.testRunner) testRunner.notifyDone();</script>\n";
+print "</body>\n";
+print "</html>\n";
</ins><span class="cx">Property changes on: releases/WebKitGTK/webkit-2.10/LayoutTests/http/tests/security/xssAuditor/resources/echo-form-action.pl
</span><span class="cx">___________________________________________________________________
</span></span></pre></div>
<a id="svnexecutable"></a>
<div class="addfile"><h4>Added: svn:executable</h4></div>
<a id="releasesWebKitGTKwebkit210ToolsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Tools/ChangeLog (195259 => 195260)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Tools/ChangeLog 2016-01-19 08:26:13 UTC (rev 195259)
+++ releases/WebKitGTK/webkit-2.10/Tools/ChangeLog 2016-01-19 08:28:45 UTC (rev 195260)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2016-01-13 Daniel Bates <dabates@apple.com>
+
+ [XSS Auditor] Add test when XSS payload is in the path portion of the URL
+ https://bugs.webkit.org/show_bug.cgi?id=152871
+
+ Reviewed by Brent Fulgham.
+
+ Merged from Blink (patch by Tom Sepez <tsepez@chromium.org>):
+ <https://src.chromium.org/viewvc/blink?revision=164746&view=revision>
+
+ * Scripts/webkitpy/layout_tests/servers/lighttpd.conf:
+
</ins><span class="cx"> 2016-01-01 Michael Catanzaro <mcatanzaro@igalia.com>
</span><span class="cx">
</span><span class="cx"> [SOUP] REGRESSION(r192761): Broke resource URIs for applications that use g_resource_load in a web extension
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210ToolsScriptswebkitpylayout_testsserverslighttpdconf"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Tools/Scripts/webkitpy/layout_tests/servers/lighttpd.conf (195259 => 195260)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Tools/Scripts/webkitpy/layout_tests/servers/lighttpd.conf 2016-01-19 08:26:13 UTC (rev 195259)
+++ releases/WebKitGTK/webkit-2.10/Tools/Scripts/webkitpy/layout_tests/servers/lighttpd.conf 2016-01-19 08:28:45 UTC (rev 195260)
</span><span class="lines">@@ -65,7 +65,8 @@
</span><span class="cx"> # LayoutTests/http/tests/appcache/resources/intercept/.htaccess
</span><span class="cx"> url.rewrite-once = (
</span><span class="cx"> "^/uri/intercept/(.*)" => "/uri/resources/print-uri.php",
</span><del>- "^/appcache/resources/intercept/(.*)" => "/appcache/resources/print-uri.php"
</del><ins>+ "^/appcache/resources/intercept/(.*)" => "/appcache/resources/print-uri.php",
+ "^/security/xssAuditor/intercept/([^/]*)/(.*)" => "/security/xssAuditor/resources/$1?q=$2"
</ins><span class="cx"> )
</span><span class="cx">
</span><span class="cx"> # LayoutTests/http/tests/xmlhttprequest/response-encoding.html uses an htaccess
</span></span></pre>
</div>
</div>
</body>
</html>