<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[204788] releases/WebKitGTK/webkit-2.12</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/204788">204788</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-08-23 02:41:17 -0700 (Tue, 23 Aug 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/201740">r201740</a> - URLs containing tabs or newlines are parsed incorrectly
https://bugs.webkit.org/show_bug.cgi?id=143381
<rdar://problem/26567214>
Reviewed by Brent Fulgham.
Source/WebCore:
1. Strip any tabs and newlines in the URL input.
2. Replace the original stripping URL leading and trailing white spaces logic with WTFString's
builtin, and move this logic to the very begining of the URL parser.
3. Enhance the protocolIs method to ignore any leading whitespace/control characters, and
tabs/newlines of the examining url.
Test: fast/url/tab-and-newline-stripping.html
* platform/URL.cpp:
(WebCore::isTabNewline):
(WebCore::shouldTrimFromURL):
(WebCore::URL::init):
(WebCore::protocolIs):
LayoutTests:
* fast/dom/DOMURL/set-href-attribute-host-expected.txt:
* fast/dom/DOMURL/set-href-attribute-host.html:
* fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-host.js:
* fast/dom/HTMLAnchorElement/set-href-attribute-host-expected.txt:
* fast/url/segments-expected.txt:
* fast/url/segments-from-data-url-expected.txt:
* fast/url/segments-from-data-url.html:
* fast/url/segments.html:
* fast/url/tab-and-newline-stripping-expected.txt: Added.
* fast/url/tab-and-newline-stripping.html: Added.
* http/tests/security/javascriptURL/javascriptURL-execution-context-frame-location-htmldom-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-getAttribute-value-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-htmldom-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttribute-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNS-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNode-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNodeNS-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-getAttribute-value-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-htmldom-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttribute-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNS-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNode-expected.txt:
* http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNodeNS-expected.txt:
* http/tests/security/xssAuditor/javascript-link-control-char2-expected.txt:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsChangeLog">releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfastdomDOMURLsethrefattributehostexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/DOMURL/set-href-attribute-host-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfastdomDOMURLsethrefattributehosthtml">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/DOMURL/set-href-attribute-host.html</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfastdomHTMLAnchorElementscripttestssethrefattributehostjs">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-host.js</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfastdomHTMLAnchorElementsethrefattributehostexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-host-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfasturlsegmentsexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfasturlsegmentsfromdataurlexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-from-data-url-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfasturlsegmentsfromdataurlhtml">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-from-data-url.html</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfasturlsegmentshtml">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments.html</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframelocationhtmldomexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-location-htmldom-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrcgetAttributevalueexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-getAttribute-value-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrchtmldomexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-htmldom-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrcsetAttributeexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttribute-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrcsetAttributeNSexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNS-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrcsetAttributeNodeexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNode-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrcsetAttributeNodeNSexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNodeNS-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrcgetAttributevalueexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-getAttribute-value-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrchtmldomexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-htmldom-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrcsetAttributeexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttribute-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrcsetAttributeNSexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNS-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrcsetAttributeNodeexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNode-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrcsetAttributeNodeNSexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNodeNS-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecurityxssAuditorjavascriptlinkcontrolchar2expectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/xssAuditor/javascript-link-control-char2-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoreplatformURLcpp">releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/URL.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfasturltabandnewlinestrippingexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/tab-and-newline-stripping-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfasturltabandnewlinestrippinghtml">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/tab-and-newline-stripping.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit212LayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,3 +1,36 @@
</span><ins>+2016-06-06 Jiewen Tan <jiewen_tan@apple.com>
+
+ URLs containing tabs or newlines are parsed incorrectly
+ https://bugs.webkit.org/show_bug.cgi?id=143381
+ <rdar://problem/26567214>
+
+ Reviewed by Brent Fulgham.
+
+ * fast/dom/DOMURL/set-href-attribute-host-expected.txt:
+ * fast/dom/DOMURL/set-href-attribute-host.html:
+ * fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-host.js:
+ * fast/dom/HTMLAnchorElement/set-href-attribute-host-expected.txt:
+ * fast/url/segments-expected.txt:
+ * fast/url/segments-from-data-url-expected.txt:
+ * fast/url/segments-from-data-url.html:
+ * fast/url/segments.html:
+ * fast/url/tab-and-newline-stripping-expected.txt: Added.
+ * fast/url/tab-and-newline-stripping.html: Added.
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-frame-location-htmldom-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-getAttribute-value-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-htmldom-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttribute-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNS-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNode-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNodeNS-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-getAttribute-value-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-htmldom-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttribute-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNS-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNode-expected.txt:
+ * http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNodeNS-expected.txt:
+ * http/tests/security/xssAuditor/javascript-link-control-char2-expected.txt:
+
</ins><span class="cx"> 2016-05-23 Ryan Haddad <ryanhaddad@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, rolling out r200414.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfastdomDOMURLsethrefattributehostexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/DOMURL/set-href-attribute-host-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/DOMURL/set-href-attribute-host-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/DOMURL/set-href-attribute-host-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -25,9 +25,6 @@
</span><span class="cx"> PASS a.href is 'file://mydomain.com/path/'
</span><span class="cx"> Set host containing slashes in it
</span><span class="cx"> PASS a.href is 'https://www.otherdom/ain.com/path/'
</span><del>-Set host to a malformed URL
-PASS a.href = "https:/\rww.my@domain.com:8080/path/" threw exception TypeError: Type error.
-PASS a.href is 'https:/\rww.my@domain.com:8080/path/'
</del><span class="cx"> Set host that starts with ':'
</span><span class="cx"> PASS a.href is 'https://domain.com:8080/path/'
</span><span class="cx"> Set host to URL containing username and ..
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfastdomDOMURLsethrefattributehosthtml"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/DOMURL/set-href-attribute-host.html (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/DOMURL/set-href-attribute-host.html 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/DOMURL/set-href-attribute-host.html 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -86,13 +86,6 @@
</span><span class="cx"> debug("Exception: " + e.description);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-// WebKit fails to strip the \r in the authority, and therefore treats the URL as invalid
-// and gets a different result than Firefox or Chrome; we should probably strip it
-debug("Set host to a malformed URL");
-shouldThrow('a.href = "https:/\\rww.my@domain.com:8080/path/"');
-a.host = "www.other!domain.com:15";
-shouldBe("a.href", "'https:/\\rww.my@domain.com:8080/path/'");
-
</del><span class="cx"> // IE8 throws an "Object Error" exception.
</span><span class="cx"> // Firefox 3.5.2 accepts this but throws an exception later
</span><span class="cx"> // WebKit should just reject
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfastdomHTMLAnchorElementscripttestssethrefattributehostjs"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-host.js (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-host.js 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-host.js 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -77,13 +77,6 @@
</span><span class="cx"> debug("Exception: " + e.description);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-// WebKit fails to strip the \r in the authority, and therefore treats the URL as invalid
-// and gets a different result than Firefox or Chrome; we should probably strip it
-debug("Set host to a malformed URL");
-a.href = "https:/\rww.my@domain.com:8080/path/";
-a.host = "www.other!domain.com:15";
-shouldBe("a.href", "'https:/\\rww.my@domain.com:8080/path/'");
-
</del><span class="cx"> // IE8 throws an "Object Error" exception.
</span><span class="cx"> // Firefox 3.5.2 accepts this but throws an exception later
</span><span class="cx"> // WebKit should just reject
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfastdomHTMLAnchorElementsethrefattributehostexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-host-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-host-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-host-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -25,8 +25,6 @@
</span><span class="cx"> PASS a.href is 'file://mydomain.com/path/'
</span><span class="cx"> Set host containing slashes in it
</span><span class="cx"> PASS a.href is 'https://www.otherdom/ain.com/path/'
</span><del>-Set host to a malformed URL
-PASS a.href is 'https:/\rww.my@domain.com:8080/path/'
</del><span class="cx"> Set host that starts with ':'
</span><span class="cx"> PASS a.href is 'https://domain.com:8080/path/'
</span><span class="cx"> Set host to URL containing username and ..
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfasturlsegmentsexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -15,7 +15,7 @@
</span><span class="cx"> FAIL segments('http://f:00000000000000000000080/c') should be ["http:","f","0","/c","",""]. Was ["http:","f","80","/c","",""].
</span><span class="cx"> PASS segments('http://f:b/c') is '[":","","","","",""]'
</span><span class="cx"> PASS segments('http://f: /c') is '[":","","","","",""]'
</span><del>-PASS segments('http://f:\n/c') is '[":","","","","",""]'
</del><ins>+PASS segments('http://f:\n/c') is '["http:","f","","/c","",""]'
</ins><span class="cx"> PASS segments('http://f:fifty-two/c') is '[":","","","","",""]'
</span><span class="cx"> FAIL segments('http://f:999999/c') should be [":","","0","","",""]. Was ["http:","f","65535","/c","",""].
</span><span class="cx"> PASS segments('http://f: 21 / b ? d # e ') is '[":","","","","",""]'
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfasturlsegmentsfromdataurlexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-from-data-url-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-from-data-url-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-from-data-url-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -15,7 +15,7 @@
</span><span class="cx"> FAIL segments('http://f:00000000000000000000080/c') should be ["http:","f","0","/c","",""]. Was ["http:","f","80","/c","",""].
</span><span class="cx"> PASS segments('http://f:b/c') is '[":","","","","",""]'
</span><span class="cx"> PASS segments('http://f: /c') is '[":","","","","",""]'
</span><del>-PASS segments('http://f:\n/c') is '[":","","","","",""]'
</del><ins>+PASS segments('http://f:\n/c') is '["http:","f","","/c","",""]'
</ins><span class="cx"> PASS segments('http://f:fifty-two/c') is '[":","","","","",""]'
</span><span class="cx"> FAIL segments('http://f:999999/c') should be [":","","0","","",""]. Was ["http:","f","65535","/c","",""].
</span><span class="cx"> PASS segments('http://f: 21 / b ? d # e ') is '[":","","","","",""]'
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfasturlsegmentsfromdataurlhtml"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-from-data-url.html (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-from-data-url.html 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments-from-data-url.html 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -22,7 +22,7 @@
</span><span class="cx"> ["http://f:00000000000000000000080/c", ["http:","f","0","/c","",""]],
</span><span class="cx"> ["http://f:b/c", [":","","","","",""]],
</span><span class="cx"> ["http://f: /c", [":","","","","",""]],
</span><del>- ["http://f:\\n/c", [":","","","","",""]],
</del><ins>+ ["http://f:\\n/c", ["http:","f","","/c","",""]],
</ins><span class="cx"> ["http://f:fifty-two/c", [":","","","","",""]],
</span><span class="cx"> ["http://f:999999/c", [":","","0","","",""]],
</span><span class="cx"> ["http://f: 21 / b ? d # e ", [":","","","","",""]],
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfasturlsegmentshtml"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments.html (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments.html 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/segments.html 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -23,7 +23,7 @@
</span><span class="cx"> ["http://f:00000000000000000000080/c", ["http:","f","0","/c","",""]],
</span><span class="cx"> ["http://f:b/c", [":","","","","",""]],
</span><span class="cx"> ["http://f: /c", [":","","","","",""]],
</span><del>- ["http://f:\\n/c", [":","","","","",""]],
</del><ins>+ ["http://f:\\n/c", ["http:","f","","/c","",""]],
</ins><span class="cx"> ["http://f:fifty-two/c", [":","","","","",""]],
</span><span class="cx"> ["http://f:999999/c", [":","","0","","",""]],
</span><span class="cx"> ["http://f: 21 / b ? d # e ", [":","","","","",""]],
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfasturltabandnewlinestrippingexpectedtxt"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/tab-and-newline-stripping-expected.txt (0 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/tab-and-newline-stripping-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/tab-and-newline-stripping-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -0,0 +1,32 @@
</span><ins>+Strip tabs and newlines according to URL spec: https://url.spec.whatwg.org/#concept-basic-url-parser
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS canonicalize('scheme://username:password@host.name:5000/path?query#fragment') is 'scheme://username:password@host.name:5000/path?query#fragment'
+PASS canonicalize('\tsch\neme\r://username:password@host.name:5000/path?query#fragment') is 'scheme://username:password@host.name:5000/path?query#fragment'
+PASS canonicalize('scheme:\t/\n/username:password@host.name:5000/path?query#fragment') is 'scheme://username:password@host.name:5000/path?query#fragment'
+PASS canonicalize('scheme://\tuser\rname\n:\rpassw\nord\t@host.name:5000/path?query#fragment') is 'scheme://username:password@host.name:5000/path?query#fragment'
+PASS canonicalize('scheme://username:password@\tho\nst\r.\tna\nme\r:5000/path?query#fragment') is 'scheme://username:password@host.name:5000/path?query#fragment'
+PASS canonicalize('scheme://username:password@host.name:\t5\n000\r/path?query#fragment') is 'scheme://username:password@host.name:5000/path?query#fragment'
+PASS canonicalize('scheme://username:password@host.name:5000/\tpa\nth\r?query#fragment') is 'scheme://username:password@host.name:5000/path?query#fragment'
+PASS canonicalize('scheme://username:password@host.name:5000/path?\tqu\nery\r#fragment') is 'scheme://username:password@host.name:5000/path?query#fragment'
+PASS canonicalize('scheme://username:password@host.name:5000/path?query#\tfr\nagment\r') is 'scheme://username:password@host.name:5000/path?query#fragment'
+PASS canonicalize('\tht\ntp\r://www.example.com/') is 'http://www.example.com/'
+PASS canonicalize('\tht\ntps\r://www.example.com/') is 'https://www.example.com/'
+PASS canonicalize('\tfi\nle\r:///var/tmp') is 'file:///var/tmp'
+PASS canonicalize('file://\n/v\tar\r/\ttm\np\r') is 'file:///var/tmp'
+PASS canonicalize('http://\n12\r7\t.0.0.1\t/') is 'http://127.0.0.1/'
+PASS canonicalize('http://\n[\r200\t1\r:\t5:\n:042:44::0370:7334\r]\t/') is 'http://[2001:5::042:44::0370:7334]/'
+PASS canonicalize('http://\tlo\ncalhost\r') is 'http://localhost/'
+PASS canonicalize('\t/\n/\rsch\teme\n/relative\r') is 'file://scheme/relative'
+PASS canonicalize('\t/\npa\rth\t/\nabsolute\r') is 'file:///path/absolute'
+PASS canonicalize('\td\nata\r:image/png;base64,invalidData') is 'data:image/png;base64,invalidData'
+PASS canonicalize('data:\tim\rage/png\n;\tbas\ne64\r,\tinv\nalidData\r') is 'data:image/png;base64,invalidData'
+PASS canonicalize('\tjav\nascript\r:alert(1);') is 'javascript:alert(1);'
+PASS canonicalize('javascript:\tal\rert\n(\n1)\t;\r') is 'javascript:alert(1);'
+PASS canonicalize(relativePathSchemeLessURL) is expectedRelativePathSchemeLessURL
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfasturltabandnewlinestrippinghtml"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/tab-and-newline-stripping.html (0 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/tab-and-newline-stripping.html (rev 0)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/url/tab-and-newline-stripping.html 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -0,0 +1,77 @@
</span><ins>+<!DOCTYPE html>
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+<script src="resources/utilities.js"></script>
+</head>
+<body>
+<script>
+description("Strip tabs and newlines according to URL spec: https://url.spec.whatwg.org/#concept-basic-url-parser");
+
+var expectedGeneralizedResult = "scheme://username:password@host.name:5000/path?query#fragment";
+generalizedCases = [
+ //normal case
+ ["scheme://username:password@host.name:5000/path?query#fragment"],
+ //add tabs and newlines at scheme
+ ["\\tsch\\neme\\r://username:password@host.name:5000/path?query#fragment"],
+ //add tabs and newlines after scheme
+ ["scheme:\\t/\\n/username:password@host.name:5000/path?query#fragment"],
+ //add tabs and newlines at credential
+ ["scheme://\\tuser\\rname\\n:\\rpassw\\nord\\t@host.name:5000/path?query#fragment"],
+ //add tabs and newlines at host
+ ["scheme://username:password@\\tho\\nst\\r.\\tna\\nme\\r:5000/path?query#fragment"],
+ //add tabs and newlines at port
+ ["scheme://username:password@host.name:\\t5\\n000\\r/path?query#fragment"],
+ //add tabs and newlines at path
+ ["scheme://username:password@host.name:5000/\\tpa\\nth\\r?query#fragment"],
+ //add tabs and newlines at query
+ ["scheme://username:password@host.name:5000/path?\\tqu\\nery\\r#fragment"],
+ //add tabs and newlines at fragment
+ ["scheme://username:password@host.name:5000/path?query#\\tfr\\nagment\\r"],
+];
+
+for (var i = 0; i < generalizedCases.length; ++i)
+ shouldBe("canonicalize('" + generalizedCases[i] + "')",
+ "'" + expectedGeneralizedResult + "'");
+
+specialCases = [
+ //http & https
+ ["\\tht\\ntp\\r://www.example.com/", "http://www.example.com/"],
+ ["\\tht\\ntps\\r://www.example.com/", "https://www.example.com/"],
+ //file URL
+ ["\\tfi\\nle\\r:///var/tmp", "file:///var/tmp"],
+ ["file://\\n/v\\tar\\r/\\ttm\\np\\r", "file:///var/tmp"],
+ //ipv4, ipv6
+ ["http://\\n12\\r7\\t.0.0.1\\t/", "http://127.0.0.1/"],
+ ["http://\\n[\\r200\\t1\\r:\\t5:\\n:042:44::0370:7334\\r]\\t/", "http://[2001:5::042:44::0370:7334]/"],
+ //localhost
+ ["http://\\tlo\\ncalhost\\r", "http://localhost/"],
+ //relative path
+ ["\\t/\\n/\\rsch\\teme\\n/relative\\r", "file://scheme/relative"],
+ ["\\t/\\npa\\rth\\t/\\nabsolute\\r", "file:///path/absolute"],
+ //data URL
+ ["\\td\\nata\\r:image/png;base64,invalidData", "data:image/png;base64,invalidData"],
+ ["data:\\tim\\rage/png\\n;\\tbas\\ne64\\r,\\tinv\\nalidData\\r", "data:image/png;base64,invalidData"],
+ //javascript URL
+ ["\\tjav\\nascript\\r:alert(1);", "javascript:alert(1);"],
+ ["javascript:\\tal\\rert\\n(\\n1)\\t;\\r", "javascript:alert(1);"],
+];
+
+for (var i = 0; i < specialCases.length; ++i)
+ shouldBe("canonicalize('" + specialCases[i][0] + "')",
+ "'" + specialCases[i][1] + "'");
+
+// relative path scheme less URL
+var URLParts = window.location.href.split( '/' );
+var path = URLParts[0];
+var len = URLParts.length - 1;
+for (i = 1; i < len; i++)
+ path += "/" + URLParts[i];
+
+var relativePathSchemeLessURL = "\tpa\nth\r/\trelative/\nscheme/less\r";
+var expectedRelativePathSchemeLessURL = path + "/path/relative/scheme/less";
+shouldBe("canonicalize(relativePathSchemeLessURL)", "expectedRelativePathSchemeLessURL");
+</script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframelocationhtmldomexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-location-htmldom-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-location-htmldom-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-location-htmldom-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> --------
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrcgetAttributevalueexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-getAttribute-value-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-getAttribute-value-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-getAttribute-value-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> --------
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrchtmldomexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-htmldom-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-htmldom-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-htmldom-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> --------
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrcsetAttributeexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttribute-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttribute-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttribute-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 32: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 33: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 35: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> --------
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrcsetAttributeNSexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNS-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNS-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNS-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 32: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 33: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 35: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> --------
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrcsetAttributeNodeexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNode-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNode-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNode-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 34: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> --------
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextframesrcsetAttributeNodeNSexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNodeNS-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNodeNS-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-frame-src-setAttributeNodeNS-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 34: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> --------
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrcgetAttributevalueexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-getAttribute-value-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-getAttribute-value-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-getAttribute-value-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 30: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 30: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 30: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx"> This test passes as long as the word 'FAIL' and an accompanying message do not appear in the subframe.
</span><span class="cx">
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrchtmldomexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-htmldom-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-htmldom-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-htmldom-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 30: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 30: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 30: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx"> This test passes as long as the word 'FAIL' and an accompanying message do not appear in the subframe.
</span><span class="cx">
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrcsetAttributeexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttribute-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttribute-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttribute-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 37: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 38: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 40: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx"> This test passes as long as the word 'FAIL' and an accompanying message do not appear in the subframe.
</span><span class="cx">
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrcsetAttributeNSexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNS-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNS-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNS-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 37: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 38: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 40: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx"> This test passes as long as the word 'FAIL' and an accompanying message do not appear in the subframe.
</span><span class="cx">
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrcsetAttributeNodeexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNode-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNode-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNode-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 39: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 30: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 30: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx"> This test passes as long as the word 'FAIL' and an accompanying message do not appear in the subframe.
</span><span class="cx">
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityjavascriptURLjavascriptURLexecutioncontextiframesrcsetAttributeNodeNSexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNodeNS-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNodeNS-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/javascriptURL/javascriptURL-execution-context-iframe-src-setAttributeNodeNS-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 39: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 30: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 30: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx"> This test passes as long as the word 'FAIL' and an accompanying message do not appear in the subframe.
</span><span class="cx">
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecurityxssAuditorjavascriptlinkcontrolchar2expectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/xssAuditor/javascript-link-control-char2-expected.txt (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/xssAuditor/javascript-link-control-char2-expected.txt 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/xssAuditor/javascript-link-control-char2-expected.txt 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1 +1,2 @@
</span><ins>+CONSOLE MESSAGE: line 14: The XSS Auditor refused to execute a script in 'http://localhost:8000/security/xssAuditor/resources/echo-intertag-click-and-notify.pl?elmid=anchorLink&q=%3Ca+id%3DanchorLink+href%3D%22%26%23x1javasc%09ript%3Aalert%28/XSS%05/%29%22%3Etest%3C/a%3E' because its source code was found within the request. The auditor was enabled because the server did not send an 'X-XSS-Protection' header.
</ins><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -1,3 +1,25 @@
</span><ins>+2016-06-06 Jiewen Tan <jiewen_tan@apple.com>
+
+ URLs containing tabs or newlines are parsed incorrectly
+ https://bugs.webkit.org/show_bug.cgi?id=143381
+ <rdar://problem/26567214>
+
+ Reviewed by Brent Fulgham.
+
+ 1. Strip any tabs and newlines in the URL input.
+ 2. Replace the original stripping URL leading and trailing white spaces logic with WTFString's
+ builtin, and move this logic to the very begining of the URL parser.
+ 3. Enhance the protocolIs method to ignore any leading whitespace/control characters, and
+ tabs/newlines of the examining url.
+
+ Test: fast/url/tab-and-newline-stripping.html
+
+ * platform/URL.cpp:
+ (WebCore::isTabNewline):
+ (WebCore::shouldTrimFromURL):
+ (WebCore::URL::init):
+ (WebCore::protocolIs):
+
</ins><span class="cx"> 2016-05-23 Ryan Haddad <ryanhaddad@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, rolling out r200414.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoreplatformURLcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/URL.cpp (204787 => 204788)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/URL.cpp 2016-08-23 09:39:53 UTC (rev 204787)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/URL.cpp 2016-08-23 09:41:17 UTC (rev 204788)
</span><span class="lines">@@ -104,7 +104,10 @@
</span><span class="cx"> PathSegmentEndChar = 1 << 5,
</span><span class="cx">
</span><span class="cx"> // not allowed in path
</span><del>- BadChar = 1 << 6
</del><ins>+ BadChar = 1 << 6,
+
+ // "\t" | "\n" | "\r"
+ TabNewline = 1 << 7
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> static const unsigned char characterClassTable[256] = {
</span><span class="lines">@@ -111,8 +114,9 @@
</span><span class="cx"> /* 0 nul */ PathSegmentEndChar, /* 1 soh */ BadChar,
</span><span class="cx"> /* 2 stx */ BadChar, /* 3 etx */ BadChar,
</span><span class="cx"> /* 4 eot */ BadChar, /* 5 enq */ BadChar, /* 6 ack */ BadChar, /* 7 bel */ BadChar,
</span><del>- /* 8 bs */ BadChar, /* 9 ht */ BadChar, /* 10 nl */ BadChar, /* 11 vt */ BadChar,
- /* 12 np */ BadChar, /* 13 cr */ BadChar, /* 14 so */ BadChar, /* 15 si */ BadChar,
</del><ins>+ /* 8 bs */ BadChar, /* 9 ht */ BadChar | TabNewline, /* 10 nl */ BadChar | TabNewline,
+ /* 11 vt */ BadChar, /* 12 np */ BadChar, /* 13 cr */ BadChar | TabNewline,
+ /* 14 so */ BadChar, /* 15 si */ BadChar,
</ins><span class="cx"> /* 16 dle */ BadChar, /* 17 dc1 */ BadChar, /* 18 dc2 */ BadChar, /* 19 dc3 */ BadChar,
</span><span class="cx"> /* 20 dc4 */ BadChar, /* 21 nak */ BadChar, /* 22 syn */ BadChar, /* 23 etb */ BadChar,
</span><span class="cx"> /* 24 can */ BadChar, /* 25 em */ BadChar, /* 26 sub */ BadChar, /* 27 esc */ BadChar,
</span><span class="lines">@@ -350,6 +354,7 @@
</span><span class="cx"> static inline bool isPathSegmentEndChar(char c) { return characterClassTable[static_cast<unsigned char>(c)] & PathSegmentEndChar; }
</span><span class="cx"> static inline bool isPathSegmentEndChar(UChar c) { return c <= 0xff && (characterClassTable[c] & PathSegmentEndChar); }
</span><span class="cx"> static inline bool isBadChar(unsigned char c) { return characterClassTable[c] & BadChar; }
</span><ins>+static inline bool isTabNewline(UChar c) { return c <= 0xff && (characterClassTable[c] & TabNewline); }
</ins><span class="cx">
</span><span class="cx"> static inline bool isSchemeCharacterMatchIgnoringCase(char character, char schemeCharacter)
</span><span class="cx"> {
</span><span class="lines">@@ -455,7 +460,7 @@
</span><span class="cx"> init(base, relative, encoding.encodingForFormSubmission());
</span><span class="cx"> }
</span><span class="cx">
</span><del>-static bool shouldTrimFromURL(unsigned char c)
</del><ins>+static bool shouldTrimFromURL(UChar c)
</ins><span class="cx"> {
</span><span class="cx"> // Browsers ignore leading/trailing whitespace and control
</span><span class="cx"> // characters from URLs. Note that c is an *unsigned* char here
</span><span class="lines">@@ -473,9 +478,14 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ // Get rid of leading and trailing whitespace and control characters.
+ String rel = relative.stripWhiteSpace(shouldTrimFromURL);
+
+ // Get rid of any tabs and newlines.
+ rel = rel.removeCharacters(isTabNewline);
+
</ins><span class="cx"> // For compatibility with Win IE, treat backslashes as if they were slashes,
</span><span class="cx"> // as long as we're not dealing with javascript: or data: URLs.
</span><del>- String rel = relative;
</del><span class="cx"> if (rel.contains('\\') && !(protocolIsJavaScript(rel) || protocolIs(rel, "data")))
</span><span class="cx"> rel = substituteBackslashes(rel);
</span><span class="cx">
</span><span class="lines">@@ -500,16 +510,6 @@
</span><span class="cx"> len = strlen(str);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- // Get rid of leading whitespace and control characters.
- while (len && shouldTrimFromURL(*str)) {
- str++;
- --len;
- }
-
- // Get rid of trailing whitespace and control characters.
- while (len && shouldTrimFromURL(str[len - 1]))
- str[--len] = '\0';
-
</del><span class="cx"> // According to the RFC, the reference should be interpreted as an
</span><span class="cx"> // absolute URI if possible, using the "leftmost, longest"
</span><span class="cx"> // algorithm. If the URI reference is absolute it will have a
</span><span class="lines">@@ -1934,12 +1934,26 @@
</span><span class="cx"> {
</span><span class="cx"> // Do the comparison without making a new string object.
</span><span class="cx"> assertProtocolIsGood(protocol);
</span><del>- for (int i = 0; ; ++i) {
- if (!protocol[i])
</del><ins>+ bool isLeading = true;
+ for (int i = 0, j = 0; url[i]; ++i) {
+ // skip leading whitespace and control characters.
+ if (isLeading && shouldTrimFromURL(url[i]))
+ continue;
+ isLeading = false;
+
+ // skip any tabs and newlines.
+ if (isTabNewline(url[i]))
+ continue;
+
+ if (!protocol[j])
</ins><span class="cx"> return url[i] == ':';
</span><del>- if (!isLetterMatchIgnoringCase(url[i], protocol[i]))
</del><ins>+ if (!isLetterMatchIgnoringCase(url[i], protocol[j]))
</ins><span class="cx"> return false;
</span><ins>+
+ ++j;
</ins><span class="cx"> }
</span><ins>+
+ return false;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool isValidProtocol(const String& protocol)
</span></span></pre>
</div>
</div>
</body>
</html>