<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[282847] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/282847">282847</a></dd>
<dt>Author</dt> <dd>bfulgham@apple.com</dd>
<dt>Date</dt> <dd>2021-09-21 16:02:16 -0700 (Tue, 21 Sep 2021)</dd>
</dl>

<h3>Log Message</h3>
<pre>Remove XSS Auditor: Part 2 (Remove engine support)
https://bugs.webkit.org/show_bug.cgi?id=230499
<rdar://problem/83318883>

Reviewed by Yusuke Suzuki.

This patch removes the implementation of the XSS Auditor from the engine, but leave the API in place so that
client software doesn't see any change in interface.

Source/WebCore:

* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* html/parser/HTMLDocumentParser.cpp:
(WebCore::HTMLDocumentParser::HTMLDocumentParser):
(WebCore::HTMLDocumentParser::pumpTokenizerLoop):
(WebCore::HTMLDocumentParser::pumpTokenizer):
* html/parser/HTMLDocumentParser.h:
* html/parser/HTMLToken.h:
(WebCore::HTMLToken::attributes const):
(WebCore::HTMLToken::eraseValueOfAttribute): Deleted.
* html/parser/XSSAuditor.cpp: Removed.
* html/parser/XSSAuditor.h: Removed.
* html/parser/XSSAuditorDelegate.cpp: Removed.
* html/parser/XSSAuditorDelegate.h: Removed.
* loader/PingLoader.cpp:
(WebCore::PingLoader::sendViolationReport):
* loader/PingLoader.h:

LayoutTests:

* fast/frames/xss-auditor-handles-file-urls-expected.txt: Removed.
* fast/frames/xss-auditor-handles-file-urls.html: Removed.
* http/tests/security/xssAuditor/anchor-url-dom-write-location-expected.txt: Removed.
* http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-expected.txt: Removed.
* http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-null-char.html: Removed.
* http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event.html: Removed.
* http/tests/security/xssAuditor/anchor-url-dom-write-location-javascript-URL-expected.txt: Removed.
* http/tests/security/xssAuditor/anchor-url-dom-write-location-javascript-URL.html: Removed.
* http/tests/security/xssAuditor/anchor-url-dom-write-location.html: Removed.
* http/tests/security/xssAuditor/anchor-url-dom-write-location2-expected.txt: Removed.
* http/tests/security/xssAuditor/anchor-url-dom-write-location2.html: Removed.
* http/tests/security/xssAuditor/base-href-control-char-expected.txt: Removed.
* http/tests/security/xssAuditor/base-href-control-char.html: Removed.
* http/tests/security/xssAuditor/base-href-direct-expected.txt: Removed.
* http/tests/security/xssAuditor/base-href-direct.html: Removed.
* http/tests/security/xssAuditor/base-href-expected.txt: Removed.
* http/tests/security/xssAuditor/base-href-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/base-href-null-char.html: Removed.
* http/tests/security/xssAuditor/base-href-safe-expected.txt: Removed.
* http/tests/security/xssAuditor/base-href-safe.html: Removed.
* http/tests/security/xssAuditor/base-href-safe2-expected.txt: Removed.
* http/tests/security/xssAuditor/base-href-safe2.html: Removed.
* http/tests/security/xssAuditor/base-href-safe3-expected.txt: Removed.
* http/tests/security/xssAuditor/base-href-safe3.html: Removed.
* http/tests/security/xssAuditor/base-href-scheme-relative-expected.txt: Removed.
* http/tests/security/xssAuditor/base-href-scheme-relative.html: Removed.
* http/tests/security/xssAuditor/base-href.html: Removed.
* http/tests/security/xssAuditor/block-does-not-leak-location-expected.txt: Removed.
* http/tests/security/xssAuditor/block-does-not-leak-location.html: Removed.
* http/tests/security/xssAuditor/block-does-not-leak-referrer-expected.txt: Removed.
* http/tests/security/xssAuditor/block-does-not-leak-referrer.html: Removed.
* http/tests/security/xssAuditor/block-does-not-leak-that-page-was-blocked-using-empty-data-url-expected.txt: Removed.
* http/tests/security/xssAuditor/block-does-not-leak-that-page-was-blocked-using-empty-data-url.html: Removed.
* http/tests/security/xssAuditor/cached-frame-expected.txt: Removed.
* http/tests/security/xssAuditor/cached-frame.html: Removed.
* http/tests/security/xssAuditor/cookie-injection-expected.txt: Removed.
* http/tests/security/xssAuditor/cookie-injection.html: Removed.
* http/tests/security/xssAuditor/crash-while-loading-tag-with-pause-expected.txt: Removed.
* http/tests/security/xssAuditor/crash-while-loading-tag-with-pause.html: Removed.
* http/tests/security/xssAuditor/data-urls-work-expected.txt: Removed.
* http/tests/security/xssAuditor/data-urls-work.html: Removed.
* http/tests/security/xssAuditor/dom-write-URL-expected.txt: Removed.
* http/tests/security/xssAuditor/dom-write-URL.html: Removed.
* http/tests/security/xssAuditor/dom-write-innerHTML-expected.txt: Removed.
* http/tests/security/xssAuditor/dom-write-innerHTML.html: Removed.
* http/tests/security/xssAuditor/dom-write-location-dom-write-open-img-onerror-expected.txt: Removed.
* http/tests/security/xssAuditor/dom-write-location-dom-write-open-img-onerror.html: Removed.
* http/tests/security/xssAuditor/dom-write-location-expected.txt: Removed.
* http/tests/security/xssAuditor/dom-write-location-inline-event-expected.txt: Removed.
* http/tests/security/xssAuditor/dom-write-location-inline-event.html: Removed.
* http/tests/security/xssAuditor/dom-write-location-javascript-URL-expected.txt: Removed.
* http/tests/security/xssAuditor/dom-write-location-javascript-URL.html: Removed.
* http/tests/security/xssAuditor/dom-write-location-open-img-onerror-expected.txt: Removed.
* http/tests/security/xssAuditor/dom-write-location-open-img-onerror.html: Removed.
* http/tests/security/xssAuditor/dom-write-location.html: Removed.
* http/tests/security/xssAuditor/embed-tag-code-attribute-2-expected.txt: Removed.
* http/tests/security/xssAuditor/embed-tag-code-attribute-2.html: Removed.
* http/tests/security/xssAuditor/embed-tag-code-attribute-expected.txt: Removed.
* http/tests/security/xssAuditor/embed-tag-code-attribute.html: Removed.
* http/tests/security/xssAuditor/embed-tag-control-char-expected.txt: Removed.
* http/tests/security/xssAuditor/embed-tag-control-char.html: Removed.
* http/tests/security/xssAuditor/embed-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/embed-tag-in-path-unterminated-expected.txt: Removed.
* http/tests/security/xssAuditor/embed-tag-in-path-unterminated.html: Removed.
* http/tests/security/xssAuditor/embed-tag-javascript-url-expected.txt: Removed.
* http/tests/security/xssAuditor/embed-tag-javascript-url.html: Removed.
* http/tests/security/xssAuditor/embed-tag-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/embed-tag-null-char.html: Removed.
* http/tests/security/xssAuditor/embed-tag.html: Removed.
* http/tests/security/xssAuditor/faux-script1-expected.txt: Removed.
* http/tests/security/xssAuditor/faux-script1.html: Removed.
* http/tests/security/xssAuditor/faux-script2-expected.txt: Removed.
* http/tests/security/xssAuditor/faux-script2.html: Removed.
* http/tests/security/xssAuditor/faux-script3-expected.txt: Removed.
* http/tests/security/xssAuditor/faux-script3.html: Removed.
* http/tests/security/xssAuditor/form-action-expected.txt: Removed.
* http/tests/security/xssAuditor/form-action.html: Removed.
* http/tests/security/xssAuditor/formaction-on-button-expected.txt: Removed.
* http/tests/security/xssAuditor/formaction-on-button.html: Removed.
* http/tests/security/xssAuditor/formaction-on-input-expected.txt: Removed.
* http/tests/security/xssAuditor/formaction-on-input.html: Removed.
* http/tests/security/xssAuditor/frameset-injection-expected.txt: Removed.
* http/tests/security/xssAuditor/frameset-injection.html: Removed.
* http/tests/security/xssAuditor/full-block-base-href-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-base-href.html: Removed.
* http/tests/security/xssAuditor/full-block-get-from-iframe-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-get-from-iframe.html: Removed.
* http/tests/security/xssAuditor/full-block-iframe-javascript-url-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-iframe-javascript-url.html: Removed.
* http/tests/security/xssAuditor/full-block-iframe-no-inherit-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-iframe-no-inherit.py: Removed.
* http/tests/security/xssAuditor/full-block-javascript-link-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-javascript-link.html: Removed.
* http/tests/security/xssAuditor/full-block-link-onclick-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-link-onclick.html: Removed.
* http/tests/security/xssAuditor/full-block-object-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-object-tag.html: Removed.
* http/tests/security/xssAuditor/full-block-post-from-iframe-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-post-from-iframe.html: Removed.
* http/tests/security/xssAuditor/full-block-script-tag-cross-domain-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-script-tag-cross-domain.html: Removed.
* http/tests/security/xssAuditor/full-block-script-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-script-tag-with-source-expected.txt: Removed.
* http/tests/security/xssAuditor/full-block-script-tag-with-source.html: Removed.
* http/tests/security/xssAuditor/full-block-script-tag.html: Removed.
* http/tests/security/xssAuditor/get-from-iframe-expected.txt: Removed.
* http/tests/security/xssAuditor/get-from-iframe.html: Removed.
* http/tests/security/xssAuditor/iframe-injection-allowed-2-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-injection-allowed-2.html: Removed.
* http/tests/security/xssAuditor/iframe-injection-allowed-3-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-injection-allowed-3.html: Removed.
* http/tests/security/xssAuditor/iframe-injection-allowed-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-injection-allowed.html: Removed.
* http/tests/security/xssAuditor/iframe-injection-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-injection.html: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-more-encoding-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-more-encoding.html: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-url-encoded-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html: Removed.
* http/tests/security/xssAuditor/iframe-javascript-url.html: Removed.
* http/tests/security/xssAuditor/iframe-onload-GBK-char-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-onload-GBK-char.html: Removed.
* http/tests/security/xssAuditor/iframe-onload-in-svg-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-onload-in-svg-tag.html: Removed.
* http/tests/security/xssAuditor/iframe-srcdoc-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-srcdoc-property-blocked-expected.txt: Removed.
* http/tests/security/xssAuditor/iframe-srcdoc-property-blocked.html: Removed.
* http/tests/security/xssAuditor/iframe-srcdoc.html: Removed.
* http/tests/security/xssAuditor/img-onerror-GBK-char-expected.txt: Removed.
* http/tests/security/xssAuditor/img-onerror-GBK-char.html: Removed.
* http/tests/security/xssAuditor/img-onerror-accented-char-expected.txt: Removed.
* http/tests/security/xssAuditor/img-onerror-accented-char.html: Removed.
* http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding-expected.txt: Removed.
* http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html: Removed.
* http/tests/security/xssAuditor/img-onerror-non-ASCII-char-expected.txt: Removed.
* http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html: Removed.
* http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding-expected.txt: Removed.
* http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html: Removed.
* http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-expected.txt: Removed.
* http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html: Removed.
* http/tests/security/xssAuditor/img-onerror-tricky-expected.txt: Removed.
* http/tests/security/xssAuditor/img-onerror-tricky.html: Removed.
* http/tests/security/xssAuditor/img-tag-with-comma-expected.txt: Removed.
* http/tests/security/xssAuditor/img-tag-with-comma.html: Removed.
* http/tests/security/xssAuditor/inline-event-HTML-entities-expected.txt: Removed.
* http/tests/security/xssAuditor/inline-event-HTML-entities.html: Removed.
* http/tests/security/xssAuditor/intercept/.htaccess: Removed.
* http/tests/security/xssAuditor/javascript-link-HTML-entities-control-char-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-HTML-entities-control-char.html: Removed.
* http/tests/security/xssAuditor/javascript-link-HTML-entities-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-HTML-entities-named-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-HTML-entities-named.html: Removed.
* http/tests/security/xssAuditor/javascript-link-HTML-entities-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-HTML-entities-null-char.html: Removed.
* http/tests/security/xssAuditor/javascript-link-HTML-entities.html: Removed.
* http/tests/security/xssAuditor/javascript-link-ampersand-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-ampersand.html: Removed.
* http/tests/security/xssAuditor/javascript-link-control-char-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-control-char.html: Removed.
* http/tests/security/xssAuditor/javascript-link-control-char2-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-control-char2.html: Removed.
* http/tests/security/xssAuditor/javascript-link-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-null-char.html: Removed.
* http/tests/security/xssAuditor/javascript-link-one-plus-one-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-one-plus-one.html: Removed.
* http/tests/security/xssAuditor/javascript-link-safe-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-safe.html: Removed.
* http/tests/security/xssAuditor/javascript-link-url-encoded-expected.txt: Removed.
* http/tests/security/xssAuditor/javascript-link-url-encoded.html: Removed.
* http/tests/security/xssAuditor/javascript-link.html: Removed.
* http/tests/security/xssAuditor/link-onclick-ampersand-expected.txt: Removed.
* http/tests/security/xssAuditor/link-onclick-ampersand.html: Removed.
* http/tests/security/xssAuditor/link-onclick-control-char-expected.txt: Removed.
* http/tests/security/xssAuditor/link-onclick-control-char.html: Removed.
* http/tests/security/xssAuditor/link-onclick-entities-expected.txt: Removed.
* http/tests/security/xssAuditor/link-onclick-entities.html: Removed.
* http/tests/security/xssAuditor/link-onclick-expected.txt: Removed.
* http/tests/security/xssAuditor/link-onclick-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/link-onclick-null-char.html: Removed.
* http/tests/security/xssAuditor/link-onclick.html: Removed.
* http/tests/security/xssAuditor/link-opens-new-window-expected.txt: Removed.
* http/tests/security/xssAuditor/link-opens-new-window.html: Removed.
* http/tests/security/xssAuditor/malformed-HTML-expected.txt: Removed.
* http/tests/security/xssAuditor/malformed-HTML.html: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-1-expected.txt: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-1.html: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-2-expected.txt: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-2.html: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-3-expected.txt: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-3.html: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-4-expected.txt: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-4.html: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-5-expected.txt: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-5.html: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-6-expected.txt: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-6.html: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-7-expected.txt: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-7.html: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-8-expected.txt: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-8.html: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-9-expected.txt: Removed.
* http/tests/security/xssAuditor/malformed-xss-protection-header-9.html: Removed.
* http/tests/security/xssAuditor/meta-tag-http-refresh-javascript-url-expected.txt: Removed.
* http/tests/security/xssAuditor/meta-tag-http-refresh-javascript-url.html: Removed.
* http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored-expected.txt: Removed.
* http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html: Removed.
* http/tests/security/xssAuditor/nested-dom-write-location-open-img-onerror-expected.txt: Removed.
* http/tests/security/xssAuditor/nested-dom-write-location-open-img-onerror.html: Removed.
* http/tests/security/xssAuditor/no-protection-script-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/no-protection-script-tag.html: Removed.
* http/tests/security/xssAuditor/non-block-javascript-url-frame-expected.txt: Removed.
* http/tests/security/xssAuditor/non-block-javascript-url-frame.html: Removed.
* http/tests/security/xssAuditor/object-embed-tag-control-char-expected.txt: Removed.
* http/tests/security/xssAuditor/object-embed-tag-control-char.html: Removed.
* http/tests/security/xssAuditor/object-embed-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/object-embed-tag-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/object-embed-tag-null-char.html: Removed.
* http/tests/security/xssAuditor/object-embed-tag.html: Removed.
* http/tests/security/xssAuditor/object-src-inject-expected.txt: Removed.
* http/tests/security/xssAuditor/object-src-inject.html: Removed.
* http/tests/security/xssAuditor/object-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/object-tag-javascript-url-expected.txt: Removed.
* http/tests/security/xssAuditor/object-tag-javascript-url.html: Removed.
* http/tests/security/xssAuditor/object-tag.html: Removed.
* http/tests/security/xssAuditor/open-attribute-body-expected.txt: Removed.
* http/tests/security/xssAuditor/open-attribute-body.html: Removed.
* http/tests/security/xssAuditor/open-event-handler-iframe-expected.txt: Removed.
* http/tests/security/xssAuditor/open-event-handler-iframe.html: Removed.
* http/tests/security/xssAuditor/open-iframe-src-01-expected.txt: Removed.
* http/tests/security/xssAuditor/open-iframe-src-01.html: Removed.
* http/tests/security/xssAuditor/open-iframe-src-02-expected.txt: Removed.
* http/tests/security/xssAuditor/open-iframe-src-02.html: Removed.
* http/tests/security/xssAuditor/open-iframe-src-03-expected.txt: Removed.
* http/tests/security/xssAuditor/open-iframe-src-03.html: Removed.
* http/tests/security/xssAuditor/open-script-src-01-expected.txt: Removed.
* http/tests/security/xssAuditor/open-script-src-01.html: Removed.
* http/tests/security/xssAuditor/open-script-src-02-expected.txt: Removed.
* http/tests/security/xssAuditor/open-script-src-02.html: Removed.
* http/tests/security/xssAuditor/open-script-src-03-expected.txt: Removed.
* http/tests/security/xssAuditor/open-script-src-03.html: Removed.
* http/tests/security/xssAuditor/open-script-src-04-expected.txt: Removed.
* http/tests/security/xssAuditor/open-script-src-04.html: Removed.
* http/tests/security/xssAuditor/post-from-iframe-expected.txt: Removed.
* http/tests/security/xssAuditor/post-from-iframe.html: Removed.
* http/tests/security/xssAuditor/property-escape-comment-01-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-comment-01.html: Removed.
* http/tests/security/xssAuditor/property-escape-comment-02-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-comment-02.html: Removed.
* http/tests/security/xssAuditor/property-escape-comment-03-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-comment-03.html: Removed.
* http/tests/security/xssAuditor/property-escape-entity-01-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-entity-01.html: Removed.
* http/tests/security/xssAuditor/property-escape-entity-02-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-entity-02.html: Removed.
* http/tests/security/xssAuditor/property-escape-entity-03-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-entity-03.html: Removed.
* http/tests/security/xssAuditor/property-escape-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-long-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-long.html: Removed.
* http/tests/security/xssAuditor/property-escape-noquotes-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-noquotes-tab-slash-chars-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-noquotes-tab-slash-chars.html: Removed.
* http/tests/security/xssAuditor/property-escape-noquotes.html: Removed.
* http/tests/security/xssAuditor/property-escape-quote-01-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-quote-01.html: Removed.
* http/tests/security/xssAuditor/property-escape-quote-02-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-quote-02.html: Removed.
* http/tests/security/xssAuditor/property-escape-quote-03-expected.txt: Removed.
* http/tests/security/xssAuditor/property-escape-quote-03.html: Removed.
* http/tests/security/xssAuditor/property-escape.html: Removed.
* http/tests/security/xssAuditor/property-inject-expected.txt: Removed.
* http/tests/security/xssAuditor/property-inject.html: Removed.
* http/tests/security/xssAuditor/reflection-in-path-expected.txt: Removed.
* http/tests/security/xssAuditor/reflection-in-path.html: Removed.
* http/tests/security/xssAuditor/regress-167121-expected.txt: Removed.
* http/tests/security/xssAuditor/regress-167121.html: Removed.
* http/tests/security/xssAuditor/report-script-tag-and-do-not-follow-redirect-when-sending-report-expected.txt: Removed.
* http/tests/security/xssAuditor/report-script-tag-and-do-not-follow-redirect-when-sending-report.html: Removed.
* http/tests/security/xssAuditor/report-script-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/report-script-tag-full-block-and-do-not-follow-redirect-when-sending-report-expected.txt: Removed.
* http/tests/security/xssAuditor/report-script-tag-full-block-and-do-not-follow-redirect-when-sending-report.html: Removed.
* http/tests/security/xssAuditor/report-script-tag-full-block-expected.txt: Removed.
* http/tests/security/xssAuditor/report-script-tag-full-block.html: Removed.
* http/tests/security/xssAuditor/report-script-tag-replace-state-expected.txt: Removed.
* http/tests/security/xssAuditor/report-script-tag-replace-state.html: Removed.
* http/tests/security/xssAuditor/report-script-tag.html: Removed.
* http/tests/security/xssAuditor/resources/anchor-url-dom-write-location-click.html: Removed.
* http/tests/security/xssAuditor/resources/base-href/base-href-safe2.html: Removed.
* http/tests/security/xssAuditor/resources/base-href/base-href-safe3.html: Removed.
* http/tests/security/xssAuditor/resources/base-href/really-safe-script.js: Removed.
* http/tests/security/xssAuditor/resources/base-href/safe-script.js: Removed.
* http/tests/security/xssAuditor/resources/echo-dom-write-URL.html: Removed.
* http/tests/security/xssAuditor/resources/echo-dom-write-innerHTML.html: Removed.
* http/tests/security/xssAuditor/resources/echo-dom-write-location.html: Removed.
* http/tests/security/xssAuditor/resources/echo-dom-write-unescaped-location.html: Removed.
* http/tests/security/xssAuditor/resources/echo-form-action.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-frame-src.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-head-base-href-direct.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-head-base-href.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-head.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-inner-tag.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-inspan.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-intertag-addslashes.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-intertag-click-and-notify.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-intertag-decode-16bit-unicode.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-intertag-default-encode.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-intertag.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-nested-dom-write-location.html: Removed.
* http/tests/security/xssAuditor/resources/echo-object-src.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-property-noquotes.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-property.pl: Removed.
* http/tests/security/xssAuditor/resources/echo-script-src.pl: Removed.
* http/tests/security/xssAuditor/resources/javascript-link-safe.html: Removed.
* http/tests/security/xssAuditor/resources/nph-cached.pl: Removed.
* http/tests/security/xssAuditor/resources/safe-script-noquotes.js: Removed.
* http/tests/security/xssAuditor/resources/safe-script.js: Removed.
* http/tests/security/xssAuditor/resources/script-tag-safe2.html: Removed.
* http/tests/security/xssAuditor/resources/script-tag-safe3.html: Removed.
* http/tests/security/xssAuditor/resources/script-tag-safe4-frame.html: Removed.
* http/tests/security/xssAuditor/resources/tag-with-pause.py: Removed.
* http/tests/security/xssAuditor/resources/utilities.js: Removed.
* http/tests/security/xssAuditor/resources/xss-filter-bypass-long-string-reply.html: Removed.
* http/tests/security/xssAuditor/resources/xss.js: Removed.
* http/tests/security/xssAuditor/script-tag-Big5-char-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-Big5-char-twice-url-encode-16bit-unicode-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-Big5-char-twice-url-encode-16bit-unicode.html: Removed.
* http/tests/security/xssAuditor/script-tag-Big5-char-twice-url-encode-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-Big5-char-twice-url-encode.html: Removed.
* http/tests/security/xssAuditor/script-tag-Big5-char.html: Removed.
* http/tests/security/xssAuditor/script-tag-Big5-char2-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-Big5-char2.html: Removed.
* http/tests/security/xssAuditor/script-tag-addslashes-backslash-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-addslashes-backslash.html: Removed.
* http/tests/security/xssAuditor/script-tag-addslashes-double-quote-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-addslashes-double-quote.html: Removed.
* http/tests/security/xssAuditor/script-tag-addslashes-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-addslashes-null-char.html: Removed.
* http/tests/security/xssAuditor/script-tag-addslashes-single-quote-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-addslashes-single-quote.html: Removed.
* http/tests/security/xssAuditor/script-tag-control-char-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-control-char.html: Removed.
* http/tests/security/xssAuditor/script-tag-convoluted-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-convoluted.html: Removed.
* http/tests/security/xssAuditor/script-tag-entities-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-entities.html: Removed.
* http/tests/security/xssAuditor/script-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-expression-follows-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-expression-follows.html: Removed.
* http/tests/security/xssAuditor/script-tag-inside-svg-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-inside-svg-tag.html: Removed.
* http/tests/security/xssAuditor/script-tag-inside-svg-tag2-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-inside-svg-tag2.html: Removed.
* http/tests/security/xssAuditor/script-tag-inside-svg-tag3-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-inside-svg-tag3.html: Removed.
* http/tests/security/xssAuditor/script-tag-near-start-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-near-start.html: Removed.
* http/tests/security/xssAuditor/script-tag-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-null-char.html: Removed.
* http/tests/security/xssAuditor/script-tag-open-redirect-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-open-redirect.html: Removed.
* http/tests/security/xssAuditor/script-tag-post-control-char-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-post-control-char.html: Removed.
* http/tests/security/xssAuditor/script-tag-post-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-post-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-post-null-char.html: Removed.
* http/tests/security/xssAuditor/script-tag-post.html: Removed.
* http/tests/security/xssAuditor/script-tag-redirect-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-redirect.html: Removed.
* http/tests/security/xssAuditor/script-tag-safe-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-safe.html: Removed.
* http/tests/security/xssAuditor/script-tag-safe2-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-safe2.html: Removed.
* http/tests/security/xssAuditor/script-tag-safe3-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-safe3.html: Removed.
* http/tests/security/xssAuditor/script-tag-safe4-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-safe4.html: Removed.
* http/tests/security/xssAuditor/script-tag-src-redirect-safe-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-src-redirect-safe.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode-surrogate-pair-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode-surrogate-pair.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode2-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode2.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode3-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode3.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode4-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode4.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode5-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-16bit-unicode5.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-actual-comma-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-actual-comma.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-callbacks-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-callbacks.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-comma-01-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-comma-01.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-comma-02-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-comma-02.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-fancy-unicode-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-fancy-unicode.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-injected-comment-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-injected-comment.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-invalid-closing-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-invalid-closing-tag.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-invalid-url-encoding-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-invalid-url-encoding.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-control-char-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-control-char.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-data-url-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-data-url.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-data-url2-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-data-url2.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-data-url3-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-data-url3.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-data-url4-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-data-url4.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-data-url5-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-data-url5.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-double-quote-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-double-quote.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-entities-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-entities.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-no-quote-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-no-quote.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-null-char-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-null-char.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-relative-scheme-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-same-host-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-same-host.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-unterminated-01-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-unterminated-01.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-unterminated-02-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-unterminated-02.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-unterminated-03-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-source-unterminated-03.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-source.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-three-times-url-encoded-16bit-unicode-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-three-times-url-encoded-16bit-unicode.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment2-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment2.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment3-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment3.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment4-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment4.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment5-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-comment5.html: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-script-and-urlencode-expected.txt: Removed.
* http/tests/security/xssAuditor/script-tag-with-trailing-script-and-urlencode.html: Removed.
* http/tests/security/xssAuditor/script-tag.html: Removed.
* http/tests/security/xssAuditor/svg-animate-expected.txt: Removed.
* http/tests/security/xssAuditor/svg-animate.html: Removed.
* http/tests/security/xssAuditor/svg-script-tag-expected.txt: Removed.
* http/tests/security/xssAuditor/svg-script-tag.html: Removed.
* http/tests/security/xssAuditor/window-open-without-url-should-not-assert-expected.txt: Removed.
* http/tests/security/xssAuditor/window-open-without-url-should-not-assert.html: Removed.
* http/tests/security/xssAuditor/xss-filter-bypass-big5-expected.txt: Removed.
* http/tests/security/xssAuditor/xss-filter-bypass-big5.html: Removed.
* http/tests/security/xssAuditor/xss-filter-bypass-long-string-expected.txt: Removed.
* http/tests/security/xssAuditor/xss-filter-bypass-long-string.html: Removed.
* http/tests/security/xssAuditor/xss-filter-bypass-sjis-expected.txt: Removed.
* http/tests/security/xssAuditor/xss-filter-bypass-sjis.html: Removed.
* http/tests/security/xssAuditor/xss-protection-parsing-01-expected.txt: Removed.
* http/tests/security/xssAuditor/xss-protection-parsing-01.html: Removed.
* http/tests/security/xssAuditor/xss-protection-parsing-02-expected.txt: Removed.
* http/tests/security/xssAuditor/xss-protection-parsing-02.html: Removed.
* http/tests/security/xssAuditor/xss-protection-parsing-03-expected.txt: Removed.
* http/tests/security/xssAuditor/xss-protection-parsing-03.html: Removed.
* http/tests/security/xssAuditor/xss-protection-parsing-04-expected.txt: Removed.
* http/tests/security/xssAuditor/xss-protection-parsing-04.html: Removed.
* platform/gtk/TestExpectations:
* platform/ios-simulator-wk2/TestExpectations:
* platform/ios-wk1/TestExpectations:
* platform/win/TestExpectations:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsplatformgtkTestExpectations">trunk/LayoutTests/platform/gtk/TestExpectations</a></li>
<li><a href="#trunkLayoutTestsplatformiossimulatorwk2TestExpectations">trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations</a></li>
<li><a href="#trunkLayoutTestsplatformioswk1TestExpectations">trunk/LayoutTests/platform/ios-wk1/TestExpectations</a></li>
<li><a href="#trunkLayoutTestsplatformwinTestExpectations">trunk/LayoutTests/platform/win/TestExpectations</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreSourcestxt">trunk/Source/WebCore/Sources.txt</a></li>
<li><a href="#trunkSourceWebCoreWebCorexcodeprojprojectpbxproj">trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceWebCorehtmlparserHTMLDocumentParsercpp">trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlparserHTMLDocumentParserh">trunk/Source/WebCore/html/parser/HTMLDocumentParser.h</a></li>
<li><a href="#trunkSourceWebCorehtmlparserHTMLTokenh">trunk/Source/WebCore/html/parser/HTMLToken.h</a></li>
<li><a href="#trunkSourceWebCoreloaderPingLoadercpp">trunk/Source/WebCore/loader/PingLoader.cpp</a></li>
<li><a href="#trunkSourceWebCoreloaderPingLoaderh">trunk/Source/WebCore/loader/PingLoader.h</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastframesxssauditorhandlesfileurlsexpectedtxt">trunk/LayoutTests/fast/frames/xss-auditor-handles-file-urls-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastframesxssauditorhandlesfileurlshtml">trunk/LayoutTests/fast/frames/xss-auditor-handles-file-urls.html</a></li>
<li>trunk/LayoutTests/http/tests/security/xssAuditor/</li>
<li><a href="#trunkSourceWebCorehtmlparserXSSAuditorcpp">trunk/Source/WebCore/html/parser/XSSAuditor.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlparserXSSAuditorh">trunk/Source/WebCore/html/parser/XSSAuditor.h</a></li>
<li><a href="#trunkSourceWebCorehtmlparserXSSAuditorDelegatecpp">trunk/Source/WebCore/html/parser/XSSAuditorDelegate.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlparserXSSAuditorDelegateh">trunk/Source/WebCore/html/parser/XSSAuditorDelegate.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog      2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/LayoutTests/ChangeLog 2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,3 +1,505 @@
</span><ins>+2021-09-21  Brent Fulgham  <bfulgham@apple.com>
+
+        Remove XSS Auditor: Part 2 (Remove engine support)
+        https://bugs.webkit.org/show_bug.cgi?id=230499
+        <rdar://problem/83318883>
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch removes the implementation of the XSS Auditor from the engine, but leave the API in place so that
+        client software doesn't see any change in interface.
+
+        * fast/frames/xss-auditor-handles-file-urls-expected.txt: Removed.
+        * fast/frames/xss-auditor-handles-file-urls.html: Removed.
+        * http/tests/security/xssAuditor/anchor-url-dom-write-location-expected.txt: Removed.
+        * http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-expected.txt: Removed.
+        * http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-null-char.html: Removed.
+        * http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event.html: Removed.
+        * http/tests/security/xssAuditor/anchor-url-dom-write-location-javascript-URL-expected.txt: Removed.
+        * http/tests/security/xssAuditor/anchor-url-dom-write-location-javascript-URL.html: Removed.
+        * http/tests/security/xssAuditor/anchor-url-dom-write-location.html: Removed.
+        * http/tests/security/xssAuditor/anchor-url-dom-write-location2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/anchor-url-dom-write-location2.html: Removed.
+        * http/tests/security/xssAuditor/base-href-control-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/base-href-control-char.html: Removed.
+        * http/tests/security/xssAuditor/base-href-direct-expected.txt: Removed.
+        * http/tests/security/xssAuditor/base-href-direct.html: Removed.
+        * http/tests/security/xssAuditor/base-href-expected.txt: Removed.
+        * http/tests/security/xssAuditor/base-href-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/base-href-null-char.html: Removed.
+        * http/tests/security/xssAuditor/base-href-safe-expected.txt: Removed.
+        * http/tests/security/xssAuditor/base-href-safe.html: Removed.
+        * http/tests/security/xssAuditor/base-href-safe2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/base-href-safe2.html: Removed.
+        * http/tests/security/xssAuditor/base-href-safe3-expected.txt: Removed.
+        * http/tests/security/xssAuditor/base-href-safe3.html: Removed.
+        * http/tests/security/xssAuditor/base-href-scheme-relative-expected.txt: Removed.
+        * http/tests/security/xssAuditor/base-href-scheme-relative.html: Removed.
+        * http/tests/security/xssAuditor/base-href.html: Removed.
+        * http/tests/security/xssAuditor/block-does-not-leak-location-expected.txt: Removed.
+        * http/tests/security/xssAuditor/block-does-not-leak-location.html: Removed.
+        * http/tests/security/xssAuditor/block-does-not-leak-referrer-expected.txt: Removed.
+        * http/tests/security/xssAuditor/block-does-not-leak-referrer.html: Removed.
+        * http/tests/security/xssAuditor/block-does-not-leak-that-page-was-blocked-using-empty-data-url-expected.txt: Removed.
+        * http/tests/security/xssAuditor/block-does-not-leak-that-page-was-blocked-using-empty-data-url.html: Removed.
+        * http/tests/security/xssAuditor/cached-frame-expected.txt: Removed.
+        * http/tests/security/xssAuditor/cached-frame.html: Removed.
+        * http/tests/security/xssAuditor/cookie-injection-expected.txt: Removed.
+        * http/tests/security/xssAuditor/cookie-injection.html: Removed.
+        * http/tests/security/xssAuditor/crash-while-loading-tag-with-pause-expected.txt: Removed.
+        * http/tests/security/xssAuditor/crash-while-loading-tag-with-pause.html: Removed.
+        * http/tests/security/xssAuditor/data-urls-work-expected.txt: Removed.
+        * http/tests/security/xssAuditor/data-urls-work.html: Removed.
+        * http/tests/security/xssAuditor/dom-write-URL-expected.txt: Removed.
+        * http/tests/security/xssAuditor/dom-write-URL.html: Removed.
+        * http/tests/security/xssAuditor/dom-write-innerHTML-expected.txt: Removed.
+        * http/tests/security/xssAuditor/dom-write-innerHTML.html: Removed.
+        * http/tests/security/xssAuditor/dom-write-location-dom-write-open-img-onerror-expected.txt: Removed.
+        * http/tests/security/xssAuditor/dom-write-location-dom-write-open-img-onerror.html: Removed.
+        * http/tests/security/xssAuditor/dom-write-location-expected.txt: Removed.
+        * http/tests/security/xssAuditor/dom-write-location-inline-event-expected.txt: Removed.
+        * http/tests/security/xssAuditor/dom-write-location-inline-event.html: Removed.
+        * http/tests/security/xssAuditor/dom-write-location-javascript-URL-expected.txt: Removed.
+        * http/tests/security/xssAuditor/dom-write-location-javascript-URL.html: Removed.
+        * http/tests/security/xssAuditor/dom-write-location-open-img-onerror-expected.txt: Removed.
+        * http/tests/security/xssAuditor/dom-write-location-open-img-onerror.html: Removed.
+        * http/tests/security/xssAuditor/dom-write-location.html: Removed.
+        * http/tests/security/xssAuditor/embed-tag-code-attribute-2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/embed-tag-code-attribute-2.html: Removed.
+        * http/tests/security/xssAuditor/embed-tag-code-attribute-expected.txt: Removed.
+        * http/tests/security/xssAuditor/embed-tag-code-attribute.html: Removed.
+        * http/tests/security/xssAuditor/embed-tag-control-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/embed-tag-control-char.html: Removed.
+        * http/tests/security/xssAuditor/embed-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/embed-tag-in-path-unterminated-expected.txt: Removed.
+        * http/tests/security/xssAuditor/embed-tag-in-path-unterminated.html: Removed.
+        * http/tests/security/xssAuditor/embed-tag-javascript-url-expected.txt: Removed.
+        * http/tests/security/xssAuditor/embed-tag-javascript-url.html: Removed.
+        * http/tests/security/xssAuditor/embed-tag-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/embed-tag-null-char.html: Removed.
+        * http/tests/security/xssAuditor/embed-tag.html: Removed.
+        * http/tests/security/xssAuditor/faux-script1-expected.txt: Removed.
+        * http/tests/security/xssAuditor/faux-script1.html: Removed.
+        * http/tests/security/xssAuditor/faux-script2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/faux-script2.html: Removed.
+        * http/tests/security/xssAuditor/faux-script3-expected.txt: Removed.
+        * http/tests/security/xssAuditor/faux-script3.html: Removed.
+        * http/tests/security/xssAuditor/form-action-expected.txt: Removed.
+        * http/tests/security/xssAuditor/form-action.html: Removed.
+        * http/tests/security/xssAuditor/formaction-on-button-expected.txt: Removed.
+        * http/tests/security/xssAuditor/formaction-on-button.html: Removed.
+        * http/tests/security/xssAuditor/formaction-on-input-expected.txt: Removed.
+        * http/tests/security/xssAuditor/formaction-on-input.html: Removed.
+        * http/tests/security/xssAuditor/frameset-injection-expected.txt: Removed.
+        * http/tests/security/xssAuditor/frameset-injection.html: Removed.
+        * http/tests/security/xssAuditor/full-block-base-href-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-base-href.html: Removed.
+        * http/tests/security/xssAuditor/full-block-get-from-iframe-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-get-from-iframe.html: Removed.
+        * http/tests/security/xssAuditor/full-block-iframe-javascript-url-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-iframe-javascript-url.html: Removed.
+        * http/tests/security/xssAuditor/full-block-iframe-no-inherit-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-iframe-no-inherit.py: Removed.
+        * http/tests/security/xssAuditor/full-block-javascript-link-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-javascript-link.html: Removed.
+        * http/tests/security/xssAuditor/full-block-link-onclick-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-link-onclick.html: Removed.
+        * http/tests/security/xssAuditor/full-block-object-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-object-tag.html: Removed.
+        * http/tests/security/xssAuditor/full-block-post-from-iframe-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-post-from-iframe.html: Removed.
+        * http/tests/security/xssAuditor/full-block-script-tag-cross-domain-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-script-tag-cross-domain.html: Removed.
+        * http/tests/security/xssAuditor/full-block-script-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-script-tag-with-source-expected.txt: Removed.
+        * http/tests/security/xssAuditor/full-block-script-tag-with-source.html: Removed.
+        * http/tests/security/xssAuditor/full-block-script-tag.html: Removed.
+        * http/tests/security/xssAuditor/get-from-iframe-expected.txt: Removed.
+        * http/tests/security/xssAuditor/get-from-iframe.html: Removed.
+        * http/tests/security/xssAuditor/iframe-injection-allowed-2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-injection-allowed-2.html: Removed.
+        * http/tests/security/xssAuditor/iframe-injection-allowed-3-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-injection-allowed-3.html: Removed.
+        * http/tests/security/xssAuditor/iframe-injection-allowed-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-injection-allowed.html: Removed.
+        * http/tests/security/xssAuditor/iframe-injection-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-injection.html: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-more-encoding-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-more-encoding.html: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-url-encoded-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html: Removed.
+        * http/tests/security/xssAuditor/iframe-javascript-url.html: Removed.
+        * http/tests/security/xssAuditor/iframe-onload-GBK-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-onload-GBK-char.html: Removed.
+        * http/tests/security/xssAuditor/iframe-onload-in-svg-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-onload-in-svg-tag.html: Removed.
+        * http/tests/security/xssAuditor/iframe-srcdoc-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-srcdoc-property-blocked-expected.txt: Removed.
+        * http/tests/security/xssAuditor/iframe-srcdoc-property-blocked.html: Removed.
+        * http/tests/security/xssAuditor/iframe-srcdoc.html: Removed.
+        * http/tests/security/xssAuditor/img-onerror-GBK-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/img-onerror-GBK-char.html: Removed.
+        * http/tests/security/xssAuditor/img-onerror-accented-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/img-onerror-accented-char.html: Removed.
+        * http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding-expected.txt: Removed.
+        * http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html: Removed.
+        * http/tests/security/xssAuditor/img-onerror-non-ASCII-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html: Removed.
+        * http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding-expected.txt: Removed.
+        * http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html: Removed.
+        * http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html: Removed.
+        * http/tests/security/xssAuditor/img-onerror-tricky-expected.txt: Removed.
+        * http/tests/security/xssAuditor/img-onerror-tricky.html: Removed.
+        * http/tests/security/xssAuditor/img-tag-with-comma-expected.txt: Removed.
+        * http/tests/security/xssAuditor/img-tag-with-comma.html: Removed.
+        * http/tests/security/xssAuditor/inline-event-HTML-entities-expected.txt: Removed.
+        * http/tests/security/xssAuditor/inline-event-HTML-entities.html: Removed.
+        * http/tests/security/xssAuditor/intercept/.htaccess: Removed.
+        * http/tests/security/xssAuditor/javascript-link-HTML-entities-control-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-HTML-entities-control-char.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link-HTML-entities-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-HTML-entities-named-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-HTML-entities-named.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link-HTML-entities-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-HTML-entities-null-char.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link-HTML-entities.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link-ampersand-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-ampersand.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link-control-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-control-char.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link-control-char2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-control-char2.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-null-char.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link-one-plus-one-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-one-plus-one.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link-safe-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-safe.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link-url-encoded-expected.txt: Removed.
+        * http/tests/security/xssAuditor/javascript-link-url-encoded.html: Removed.
+        * http/tests/security/xssAuditor/javascript-link.html: Removed.
+        * http/tests/security/xssAuditor/link-onclick-ampersand-expected.txt: Removed.
+        * http/tests/security/xssAuditor/link-onclick-ampersand.html: Removed.
+        * http/tests/security/xssAuditor/link-onclick-control-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/link-onclick-control-char.html: Removed.
+        * http/tests/security/xssAuditor/link-onclick-entities-expected.txt: Removed.
+        * http/tests/security/xssAuditor/link-onclick-entities.html: Removed.
+        * http/tests/security/xssAuditor/link-onclick-expected.txt: Removed.
+        * http/tests/security/xssAuditor/link-onclick-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/link-onclick-null-char.html: Removed.
+        * http/tests/security/xssAuditor/link-onclick.html: Removed.
+        * http/tests/security/xssAuditor/link-opens-new-window-expected.txt: Removed.
+        * http/tests/security/xssAuditor/link-opens-new-window.html: Removed.
+        * http/tests/security/xssAuditor/malformed-HTML-expected.txt: Removed.
+        * http/tests/security/xssAuditor/malformed-HTML.html: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-1-expected.txt: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-1.html: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-2.html: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-3-expected.txt: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-3.html: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-4-expected.txt: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-4.html: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-5-expected.txt: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-5.html: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-6-expected.txt: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-6.html: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-7-expected.txt: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-7.html: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-8-expected.txt: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-8.html: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-9-expected.txt: Removed.
+        * http/tests/security/xssAuditor/malformed-xss-protection-header-9.html: Removed.
+        * http/tests/security/xssAuditor/meta-tag-http-refresh-javascript-url-expected.txt: Removed.
+        * http/tests/security/xssAuditor/meta-tag-http-refresh-javascript-url.html: Removed.
+        * http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored-expected.txt: Removed.
+        * http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html: Removed.
+        * http/tests/security/xssAuditor/nested-dom-write-location-open-img-onerror-expected.txt: Removed.
+        * http/tests/security/xssAuditor/nested-dom-write-location-open-img-onerror.html: Removed.
+        * http/tests/security/xssAuditor/no-protection-script-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/no-protection-script-tag.html: Removed.
+        * http/tests/security/xssAuditor/non-block-javascript-url-frame-expected.txt: Removed.
+        * http/tests/security/xssAuditor/non-block-javascript-url-frame.html: Removed.
+        * http/tests/security/xssAuditor/object-embed-tag-control-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/object-embed-tag-control-char.html: Removed.
+        * http/tests/security/xssAuditor/object-embed-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/object-embed-tag-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/object-embed-tag-null-char.html: Removed.
+        * http/tests/security/xssAuditor/object-embed-tag.html: Removed.
+        * http/tests/security/xssAuditor/object-src-inject-expected.txt: Removed.
+        * http/tests/security/xssAuditor/object-src-inject.html: Removed.
+        * http/tests/security/xssAuditor/object-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/object-tag-javascript-url-expected.txt: Removed.
+        * http/tests/security/xssAuditor/object-tag-javascript-url.html: Removed.
+        * http/tests/security/xssAuditor/object-tag.html: Removed.
+        * http/tests/security/xssAuditor/open-attribute-body-expected.txt: Removed.
+        * http/tests/security/xssAuditor/open-attribute-body.html: Removed.
+        * http/tests/security/xssAuditor/open-event-handler-iframe-expected.txt: Removed.
+        * http/tests/security/xssAuditor/open-event-handler-iframe.html: Removed.
+        * http/tests/security/xssAuditor/open-iframe-src-01-expected.txt: Removed.
+        * http/tests/security/xssAuditor/open-iframe-src-01.html: Removed.
+        * http/tests/security/xssAuditor/open-iframe-src-02-expected.txt: Removed.
+        * http/tests/security/xssAuditor/open-iframe-src-02.html: Removed.
+        * http/tests/security/xssAuditor/open-iframe-src-03-expected.txt: Removed.
+        * http/tests/security/xssAuditor/open-iframe-src-03.html: Removed.
+        * http/tests/security/xssAuditor/open-script-src-01-expected.txt: Removed.
+        * http/tests/security/xssAuditor/open-script-src-01.html: Removed.
+        * http/tests/security/xssAuditor/open-script-src-02-expected.txt: Removed.
+        * http/tests/security/xssAuditor/open-script-src-02.html: Removed.
+        * http/tests/security/xssAuditor/open-script-src-03-expected.txt: Removed.
+        * http/tests/security/xssAuditor/open-script-src-03.html: Removed.
+        * http/tests/security/xssAuditor/open-script-src-04-expected.txt: Removed.
+        * http/tests/security/xssAuditor/open-script-src-04.html: Removed.
+        * http/tests/security/xssAuditor/post-from-iframe-expected.txt: Removed.
+        * http/tests/security/xssAuditor/post-from-iframe.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-comment-01-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-comment-01.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-comment-02-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-comment-02.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-comment-03-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-comment-03.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-entity-01-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-entity-01.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-entity-02-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-entity-02.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-entity-03-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-entity-03.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-long-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-long.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-noquotes-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-noquotes-tab-slash-chars-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-noquotes-tab-slash-chars.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-noquotes.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-quote-01-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-quote-01.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-quote-02-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-quote-02.html: Removed.
+        * http/tests/security/xssAuditor/property-escape-quote-03-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-escape-quote-03.html: Removed.
+        * http/tests/security/xssAuditor/property-escape.html: Removed.
+        * http/tests/security/xssAuditor/property-inject-expected.txt: Removed.
+        * http/tests/security/xssAuditor/property-inject.html: Removed.
+        * http/tests/security/xssAuditor/reflection-in-path-expected.txt: Removed.
+        * http/tests/security/xssAuditor/reflection-in-path.html: Removed.
+        * http/tests/security/xssAuditor/regress-167121-expected.txt: Removed.
+        * http/tests/security/xssAuditor/regress-167121.html: Removed.
+        * http/tests/security/xssAuditor/report-script-tag-and-do-not-follow-redirect-when-sending-report-expected.txt: Removed.
+        * http/tests/security/xssAuditor/report-script-tag-and-do-not-follow-redirect-when-sending-report.html: Removed.
+        * http/tests/security/xssAuditor/report-script-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/report-script-tag-full-block-and-do-not-follow-redirect-when-sending-report-expected.txt: Removed.
+        * http/tests/security/xssAuditor/report-script-tag-full-block-and-do-not-follow-redirect-when-sending-report.html: Removed.
+        * http/tests/security/xssAuditor/report-script-tag-full-block-expected.txt: Removed.
+        * http/tests/security/xssAuditor/report-script-tag-full-block.html: Removed.
+        * http/tests/security/xssAuditor/report-script-tag-replace-state-expected.txt: Removed.
+        * http/tests/security/xssAuditor/report-script-tag-replace-state.html: Removed.
+        * http/tests/security/xssAuditor/report-script-tag.html: Removed.
+        * http/tests/security/xssAuditor/resources/anchor-url-dom-write-location-click.html: Removed.
+        * http/tests/security/xssAuditor/resources/base-href/base-href-safe2.html: Removed.
+        * http/tests/security/xssAuditor/resources/base-href/base-href-safe3.html: Removed.
+        * http/tests/security/xssAuditor/resources/base-href/really-safe-script.js: Removed.
+        * http/tests/security/xssAuditor/resources/base-href/safe-script.js: Removed.
+        * http/tests/security/xssAuditor/resources/echo-dom-write-URL.html: Removed.
+        * http/tests/security/xssAuditor/resources/echo-dom-write-innerHTML.html: Removed.
+        * http/tests/security/xssAuditor/resources/echo-dom-write-location.html: Removed.
+        * http/tests/security/xssAuditor/resources/echo-dom-write-unescaped-location.html: Removed.
+        * http/tests/security/xssAuditor/resources/echo-form-action.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-frame-src.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-head-base-href-direct.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-head-base-href.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-head.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-inner-tag.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-inspan.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-intertag-addslashes.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-intertag-click-and-notify.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-intertag-decode-16bit-unicode.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-intertag-default-encode.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-intertag.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-nested-dom-write-location.html: Removed.
+        * http/tests/security/xssAuditor/resources/echo-object-src.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-property-noquotes.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-property.pl: Removed.
+        * http/tests/security/xssAuditor/resources/echo-script-src.pl: Removed.
+        * http/tests/security/xssAuditor/resources/javascript-link-safe.html: Removed.
+        * http/tests/security/xssAuditor/resources/nph-cached.pl: Removed.
+        * http/tests/security/xssAuditor/resources/safe-script-noquotes.js: Removed.
+        * http/tests/security/xssAuditor/resources/safe-script.js: Removed.
+        * http/tests/security/xssAuditor/resources/script-tag-safe2.html: Removed.
+        * http/tests/security/xssAuditor/resources/script-tag-safe3.html: Removed.
+        * http/tests/security/xssAuditor/resources/script-tag-safe4-frame.html: Removed.
+        * http/tests/security/xssAuditor/resources/tag-with-pause.py: Removed.
+        * http/tests/security/xssAuditor/resources/utilities.js: Removed.
+        * http/tests/security/xssAuditor/resources/xss-filter-bypass-long-string-reply.html: Removed.
+        * http/tests/security/xssAuditor/resources/xss.js: Removed.
+        * http/tests/security/xssAuditor/script-tag-Big5-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-Big5-char-twice-url-encode-16bit-unicode-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-Big5-char-twice-url-encode-16bit-unicode.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-Big5-char-twice-url-encode-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-Big5-char-twice-url-encode.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-Big5-char.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-Big5-char2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-Big5-char2.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-addslashes-backslash-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-addslashes-backslash.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-addslashes-double-quote-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-addslashes-double-quote.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-addslashes-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-addslashes-null-char.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-addslashes-single-quote-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-addslashes-single-quote.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-control-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-control-char.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-convoluted-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-convoluted.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-entities-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-entities.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-expression-follows-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-expression-follows.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-inside-svg-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-inside-svg-tag.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-inside-svg-tag2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-inside-svg-tag2.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-inside-svg-tag3-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-inside-svg-tag3.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-near-start-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-near-start.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-null-char.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-open-redirect-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-open-redirect.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-post-control-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-post-control-char.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-post-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-post-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-post-null-char.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-post.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-redirect-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-redirect.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-safe-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-safe.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-safe2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-safe2.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-safe3-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-safe3.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-safe4-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-safe4.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-src-redirect-safe-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-src-redirect-safe.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode-surrogate-pair-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode-surrogate-pair.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode2.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode3-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode3.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode4-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode4.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode5-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-16bit-unicode5.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-actual-comma-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-actual-comma.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-callbacks-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-callbacks.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-comma-01-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-comma-01.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-comma-02-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-comma-02.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-fancy-unicode-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-fancy-unicode.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-injected-comment-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-injected-comment.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-invalid-closing-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-invalid-closing-tag.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-invalid-url-encoding-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-invalid-url-encoding.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-control-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-control-char.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url2.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url3-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url3.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url4-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url4.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url5-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url5.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-double-quote-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-double-quote.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-entities-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-entities.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-no-quote-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-no-quote.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-null-char-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-null-char.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-relative-scheme-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-same-host-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-same-host.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-unterminated-01-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-unterminated-01.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-unterminated-02-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-unterminated-02.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-unterminated-03-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source-unterminated-03.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-source.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-three-times-url-encoded-16bit-unicode-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-three-times-url-encoded-16bit-unicode.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment2-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment2.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment3-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment3.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment4-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment4.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment5-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-comment5.html: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-script-and-urlencode-expected.txt: Removed.
+        * http/tests/security/xssAuditor/script-tag-with-trailing-script-and-urlencode.html: Removed.
+        * http/tests/security/xssAuditor/script-tag.html: Removed.
+        * http/tests/security/xssAuditor/svg-animate-expected.txt: Removed.
+        * http/tests/security/xssAuditor/svg-animate.html: Removed.
+        * http/tests/security/xssAuditor/svg-script-tag-expected.txt: Removed.
+        * http/tests/security/xssAuditor/svg-script-tag.html: Removed.
+        * http/tests/security/xssAuditor/window-open-without-url-should-not-assert-expected.txt: Removed.
+        * http/tests/security/xssAuditor/window-open-without-url-should-not-assert.html: Removed.
+        * http/tests/security/xssAuditor/xss-filter-bypass-big5-expected.txt: Removed.
+        * http/tests/security/xssAuditor/xss-filter-bypass-big5.html: Removed.
+        * http/tests/security/xssAuditor/xss-filter-bypass-long-string-expected.txt: Removed.
+        * http/tests/security/xssAuditor/xss-filter-bypass-long-string.html: Removed.
+        * http/tests/security/xssAuditor/xss-filter-bypass-sjis-expected.txt: Removed.
+        * http/tests/security/xssAuditor/xss-filter-bypass-sjis.html: Removed.
+        * http/tests/security/xssAuditor/xss-protection-parsing-01-expected.txt: Removed.
+        * http/tests/security/xssAuditor/xss-protection-parsing-01.html: Removed.
+        * http/tests/security/xssAuditor/xss-protection-parsing-02-expected.txt: Removed.
+        * http/tests/security/xssAuditor/xss-protection-parsing-02.html: Removed.
+        * http/tests/security/xssAuditor/xss-protection-parsing-03-expected.txt: Removed.
+        * http/tests/security/xssAuditor/xss-protection-parsing-03.html: Removed.
+        * http/tests/security/xssAuditor/xss-protection-parsing-04-expected.txt: Removed.
+        * http/tests/security/xssAuditor/xss-protection-parsing-04.html: Removed.
+        * platform/gtk/TestExpectations:
+        * platform/ios-simulator-wk2/TestExpectations:
+        * platform/ios-wk1/TestExpectations:
+        * platform/win/TestExpectations:
+
</ins><span class="cx"> 2021-09-21  Arcady Goldmints-Orlov  <agoldmints@igalia.com>
</span><span class="cx"> 
</span><span class="cx">         [GLIB] Update test expectations for newly passing tests.
</span></span></pre></div>
<a id="trunkLayoutTestsfastframesxssauditorhandlesfileurlsexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/fast/frames/xss-auditor-handles-file-urls-expected.txt (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/frames/xss-auditor-handles-file-urls-expected.txt 2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/LayoutTests/fast/frames/xss-auditor-handles-file-urls-expected.txt    2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,2 +0,0 @@
</span><del>-CONSOLE MESSAGE: The XSS Auditor refused to execute a script in 'html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==%27%3E' because its source code was found within the request. The auditor was enabled because the server did not send an 'X-XSS-Protection' header.
-
</del></span></pre></div>
<a id="trunkLayoutTestsfastframesxssauditorhandlesfileurlshtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/fast/frames/xss-auditor-handles-file-urls.html (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/frames/xss-auditor-handles-file-urls.html 2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/LayoutTests/fast/frames/xss-auditor-handles-file-urls.html    2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,14 +0,0 @@
</span><del>-<!DOCTYPE html><!-- webkit-test-runner [ XSSAuditorEnabled=true ] -->
-<html>
-<head>
-<script>
-if (window.testRunner) {
-  testRunner.dumpAsText();
-}
-</script>
-</head>
-<body>
-<iframe src="resources/static-xss-vector.html?q=XSS<iframe src='data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='>">
-</iframe>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsplatformgtkTestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/gtk/TestExpectations (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/gtk/TestExpectations  2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/LayoutTests/platform/gtk/TestExpectations     2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1484,9 +1484,6 @@
</span><span class="cx"> 
</span><span class="cx"> Bug(GTK) http/tests/misc/iframe-beforeunload-dialog-matching-ancestor-securityorigin.html [ Failure ]
</span><span class="cx"> 
</span><del>-Bug(GTK) http/tests/security/xssAuditor/xss-filter-bypass-big5.html [ Failure ]
-Bug(GTK) http/tests/security/xssAuditor/xss-filter-bypass-sjis.html [ Failure ]
-
</del><span class="cx"> Bug(GTK) fast/backgrounds/background-position-parsing.html [ Failure ]
</span><span class="cx"> 
</span><span class="cx"> Bug(GTK) fast/css/sticky/sticky-top-zoomed.html [ ImageOnlyFailure ]
</span></span></pre></div>
<a id="trunkLayoutTestsplatformiossimulatorwk2TestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations    2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations       2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -97,8 +97,6 @@
</span><span class="cx"> 
</span><span class="cx"> webkit.org/b/214732 imported/w3c/web-platform-tests/IndexedDB/key-generators/reading-autoincrement-store.any.serviceworker.html [ Pass Failure ]
</span><span class="cx"> 
</span><del>-webkit.org/b/214735 http/tests/security/xssAuditor/cached-frame.html [ Pass Timeout ]
-
</del><span class="cx"> webkit.org/b/214736 imported/w3c/web-platform-tests/css/css-flexbox/align-self-014.html [ Pass Timeout ]
</span><span class="cx"> 
</span><span class="cx"> webkit.org/b/214739 [ Debug ] imported/w3c/web-platform-tests/css/css-flexbox/getcomputedstyle/flexbox_computedstyle_align-content-center.html [ Pass Timeout ]
</span></span></pre></div>
<a id="trunkLayoutTestsplatformioswk1TestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/ios-wk1/TestExpectations (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/ios-wk1/TestExpectations      2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/LayoutTests/platform/ios-wk1/TestExpectations 2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1105,7 +1105,6 @@
</span><span class="cx"> http/tests/security/redirect-BLOCKED-to-localURL.html [ Failure ]
</span><span class="cx"> http/tests/security/video-cross-origin-accessfailure.html [ Failure ]
</span><span class="cx"> http/tests/security/video-cross-origin-readback.html [ Failure ]
</span><del>-http/tests/security/xssAuditor/link-opens-new-window.html [ Failure ]
</del><span class="cx"> 
</span><span class="cx"> http/tests/plugins/nounsupported-plugin.html [ Skip ]
</span><span class="cx"> http/tests/plugins/supported-plugin-all-origin-visibility.html [ Skip ]
</span></span></pre></div>
<a id="trunkLayoutTestsplatformwinTestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/win/TestExpectations (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/win/TestExpectations  2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/LayoutTests/platform/win/TestExpectations     2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -2316,7 +2316,6 @@
</span><span class="cx"> http/tests/security/storage-blocking-strengthened-plugin.html [ Failure ]
</span><span class="cx"> http/tests/security/storage-blocking-strengthened-private-browsing-plugin.html [ Failure ]
</span><span class="cx"> http/tests/security/storage-blocking-strengthened-websql.html [ Failure ]
</span><del>-http/tests/security/xssAuditor/script-tag-with-callbacks.html [ Failure ]
</del><span class="cx"> http/tests/ssl/ping-with-unsafe-redirect.html [ Failure ]
</span><span class="cx"> http/tests/ssl/referer-301.html [ Failure ]
</span><span class="cx"> http/tests/ssl/referer-303.html [ Failure ]
</span><span class="lines">@@ -2708,7 +2707,6 @@
</span><span class="cx"> webkit.org/b/117323 fast/frames/sandboxed-iframe-about-blank.html [ Failure ]
</span><span class="cx"> webkit.org/b/117323 fast/frames/sandboxed-iframe-navigation-allowed.html [ Failure ]
</span><span class="cx"> fast/frames/sandboxed-iframe-scripting-05.html [ Pass Timeout ]
</span><del>-webkit.org/b/112764 fast/frames/xss-auditor-handles-file-urls.html [ Failure ]
</del><span class="cx"> 
</span><span class="cx"> fast/harness/results.html [ Failure ]
</span><span class="cx"> 
</span><span class="lines">@@ -3583,7 +3581,6 @@
</span><span class="cx"> http/tests/security/contentSecurityPolicy/cross-origin-plugin-document-allowed-in-child-window.html [ Skip ]
</span><span class="cx"> http/tests/security/contentSecurityPolicy/same-origin-plugin-document-blocked-in-child-window.html [ Skip ]
</span><span class="cx"> http/tests/security/move-iframe-within-focus-handler-inside-removal.html [ Skip ]
</span><del>-http/tests/security/xssAuditor/regress-167121.html [ Skip ]
</del><span class="cx"> http/tests/websocket/tests/hybi/inspector/before-load.html [ Skip ]
</span><span class="cx"> http/tests/websocket/tests/hybi/inspector/binary.html [ Skip ]
</span><span class="cx"> http/tests/websocket/tests/hybi/inspector/client-close.html [ Skip ]
</span><span class="lines">@@ -3908,7 +3905,6 @@
</span><span class="cx"> webkit.org/b/182694 fast/loader/document-destruction-within-unload.html [ Crash ]
</span><span class="cx"> webkit.org/b/182694 fast/text/invalid-positionForPoint-offset.html [ Crash ]
</span><span class="cx"> webkit.org/b/182694 http/tests/security/svg-image-with-cached-remote-image.html [ Crash ]
</span><del>-webkit.org/b/182694 http/tests/security/xssAuditor/iframe-onload-in-svg-tag.html [ Crash ]
</del><span class="cx"> webkit.org/b/182694 imported/blink/http/tests/svg/svgload-vs-load.svg [ Crash ]
</span><span class="cx"> webkit.org/b/182694 imported/blink/svg/animations/repeatn-event-1a.svg [ Crash ]
</span><span class="cx"> webkit.org/b/182694 imported/blink/svg/animations/repeatn-event-1e.svg [ Crash ]
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog   2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/ChangeLog      2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,3 +1,32 @@
</span><ins>+2021-09-21  Brent Fulgham  <bfulgham@apple.com>
+
+        Remove XSS Auditor: Part 2 (Remove engine support)
+        https://bugs.webkit.org/show_bug.cgi?id=230499
+        <rdar://problem/83318883>
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch removes the implementation of the XSS Auditor from the engine, but leave the API in place so that
+        client software doesn't see any change in interface.
+
+        * Sources.txt:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::HTMLDocumentParser):
+        (WebCore::HTMLDocumentParser::pumpTokenizerLoop):
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        * html/parser/HTMLDocumentParser.h:
+        * html/parser/HTMLToken.h:
+        (WebCore::HTMLToken::attributes const):
+        (WebCore::HTMLToken::eraseValueOfAttribute): Deleted.
+        * html/parser/XSSAuditor.cpp: Removed.
+        * html/parser/XSSAuditor.h: Removed.
+        * html/parser/XSSAuditorDelegate.cpp: Removed.
+        * html/parser/XSSAuditorDelegate.h: Removed.
+        * loader/PingLoader.cpp:
+        (WebCore::PingLoader::sendViolationReport):
+        * loader/PingLoader.h:
+
</ins><span class="cx"> 2021-09-21  David Kilzer  <ddkilzer@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Rename {checked,dynamic}_ns_cast<> to {checked,dynamic}_objc_cast<>
</span></span></pre></div>
<a id="trunkSourceWebCoreSourcestxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/Sources.txt (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/Sources.txt 2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/Sources.txt    2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1361,8 +1361,6 @@
</span><span class="cx"> html/parser/HTMLTokenizer.cpp
</span><span class="cx"> html/parser/HTMLTreeBuilder.cpp
</span><span class="cx"> html/parser/TextDocumentParser.cpp
</span><del>-html/parser/XSSAuditor.cpp
-html/parser/XSSAuditorDelegate.cpp
</del><span class="cx"> html/shadow/AutoFillButtonElement.cpp
</span><span class="cx"> html/shadow/DataListButtonElement.cpp
</span><span class="cx"> html/shadow/DetailsMarkerControl.cpp
</span></span></pre></div>
<a id="trunkSourceWebCoreWebCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj   2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj      2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -3126,8 +3126,6 @@
</span><span class="cx">          977B3876122883E900B81FF8 /* HTMLScriptRunnerHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 977B385D122883E900B81FF8 /* HTMLScriptRunnerHost.h */; };
</span><span class="cx">          977B3878122883E900B81FF8 /* HTMLTokenizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 977B385F122883E900B81FF8 /* HTMLTokenizer.h */; };
</span><span class="cx">          977E2DCE12F0E28300C13379 /* HTMLSourceTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 977E2DCC12F0E28300C13379 /* HTMLSourceTracker.h */; };
</span><del>-               977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */ = {isa = PBXBuildFile; fileRef = 977E2E0C12F0FC9C00C13379 /* XSSAuditor.h */; };
-               977E2E0F12F0FC9C00C13380 /* XSSAuditorDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 977E2E0C12F0FC9C00C13380 /* XSSAuditorDelegate.h */; };
</del><span class="cx">           978AD67514130A8D00C7CAE3 /* HTMLSpanElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 978AD67214130A8D00C7CAE3 /* HTMLSpanElement.h */; };
</span><span class="cx">          979F43D41075E44A0000F83B /* NavigationScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 979F43D21075E44A0000F83B /* NavigationScheduler.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          97AA3CA5145237CC003E1DA6 /* EventTargetHeaders.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AA3CA3145237CC003E1DA6 /* EventTargetHeaders.h */; };
</span><span class="lines">@@ -12298,10 +12296,6 @@
</span><span class="cx">          977B385F122883E900B81FF8 /* HTMLTokenizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLTokenizer.h; sourceTree = "<group>"; };
</span><span class="cx">          977E2DCB12F0E28300C13379 /* HTMLSourceTracker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLSourceTracker.cpp; sourceTree = "<group>"; };
</span><span class="cx">          977E2DCC12F0E28300C13379 /* HTMLSourceTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLSourceTracker.h; sourceTree = "<group>"; };
</span><del>-               977E2E0B12F0FC9C00C13379 /* XSSAuditor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSSAuditor.cpp; sourceTree = "<group>"; };
-               977E2E0B12F0FC9C00C13380 /* XSSAuditorDelegate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSSAuditorDelegate.cpp; sourceTree = "<group>"; };
-               977E2E0C12F0FC9C00C13379 /* XSSAuditor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XSSAuditor.h; sourceTree = "<group>"; };
-               977E2E0C12F0FC9C00C13380 /* XSSAuditorDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XSSAuditorDelegate.h; sourceTree = "<group>"; };
</del><span class="cx">           978AD67114130A8D00C7CAE3 /* HTMLSpanElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLSpanElement.cpp; sourceTree = "<group>"; };
</span><span class="cx">          978AD67214130A8D00C7CAE3 /* HTMLSpanElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLSpanElement.h; sourceTree = "<group>"; };
</span><span class="cx">          978AD67314130A8D00C7CAE3 /* HTMLSpanElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLSpanElement.idl; sourceTree = "<group>"; };
</span><span class="lines">@@ -24543,10 +24537,6 @@
</span><span class="cx">                          536D5A22193E8E0C00CE4CAB /* ParsingUtilities.h */,
</span><span class="cx">                          97BC84811236FD93000C6161 /* TextDocumentParser.cpp */,
</span><span class="cx">                          97BC84821236FD93000C6161 /* TextDocumentParser.h */,
</span><del>-                               977E2E0B12F0FC9C00C13379 /* XSSAuditor.cpp */,
-                               977E2E0C12F0FC9C00C13379 /* XSSAuditor.h */,
-                               977E2E0B12F0FC9C00C13380 /* XSSAuditorDelegate.cpp */,
-                               977E2E0C12F0FC9C00C13380 /* XSSAuditorDelegate.h */,
</del><span class="cx">                   );
</span><span class="cx">                  path = parser;
</span><span class="cx">                  sourceTree = "<group>";
</span><span class="lines">@@ -36000,8 +35990,6 @@
</span><span class="cx">                          E1F1E8300C3C2BB9006DB391 /* XSLTExtensions.h in Headers */,
</span><span class="cx">                          93F199ED08245E59001E9ABC /* XSLTProcessor.h in Headers */,
</span><span class="cx">                          E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
</span><del>-                               977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */,
-                               977E2E0F12F0FC9C00C13380 /* XSSAuditorDelegate.h in Headers */,
</del><span class="cx">                           A5416FE618810EF80009FC5F /* YouTubeEmbedShadowElement.h in Headers */,
</span><span class="cx">                          7A5515F5191830A3009687D2 /* YouTubePluginReplacement.h in Headers */,
</span><span class="cx">                          FD537353137B651800008DCE /* ZeroPole.h in Headers */,
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlparserHTMLDocumentParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp  2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp     2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
</span><del>- * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -64,7 +64,6 @@
</span><span class="cx">     , m_scriptRunner(makeUnique<HTMLScriptRunner>(document, static_cast<HTMLScriptRunnerHost&>(*this)))
</span><span class="cx">     , m_treeBuilder(makeUnique<HTMLTreeBuilder>(*this, document, parserContentPolicy(), m_options))
</span><span class="cx">     , m_parserScheduler(makeUnique<HTMLParserScheduler>(*this))
</span><del>-    , m_xssAuditorDelegate(document)
</del><span class="cx">     , m_preloader(makeUnique<HTMLResourcePreloader>(document))
</span><span class="cx">     , m_shouldEmitTracePoints(isMainDocumentLoadingFromHTTP(document))
</span><span class="cx"> {
</span><span class="lines">@@ -80,13 +79,11 @@
</span><span class="cx">     , m_options(fragment.document())
</span><span class="cx">     , m_tokenizer(m_options)
</span><span class="cx">     , m_treeBuilder(makeUnique<HTMLTreeBuilder>(*this, fragment, contextElement, parserContentPolicy(), m_options))
</span><del>-    , m_xssAuditorDelegate(fragment.document())
</del><span class="cx">     , m_shouldEmitTracePoints(false) // Avoid emitting trace points when parsing fragments like outerHTML.
</span><span class="cx"> {
</span><span class="cx">     // https://html.spec.whatwg.org/multipage/syntax.html#parsing-html-fragments
</span><span class="cx">     if (contextElement.isHTMLElement())
</span><span class="cx">         m_tokenizer.updateStateFor(contextElement.tagQName().localName());
</span><del>-    m_xssAuditor.initForFragment();
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline Ref<HTMLDocumentParser> HTMLDocumentParser::create(DocumentFragment& fragment, Element& contextElement, ParserContentPolicy parserContentPolicy)
</span><span class="lines">@@ -284,15 +281,9 @@
</span><span class="cx">         if (!token)
</span><span class="cx">             return false;
</span><span class="cx"> 
</span><del>-        if (!parsingFragment) {
</del><ins>+        if (!parsingFragment)
</ins><span class="cx">             m_sourceTracker.endToken(m_input.current(), m_tokenizer);
</span><span class="cx"> 
</span><del>-            // We do not XSS filter innerHTML, which means we (intentionally) fail
-            // http/tests/security/xssAuditor/dom-write-innerHTML.html
-            if (auto xssInfo = m_xssAuditor.filterToken(FilterTokenRequest(*token, m_sourceTracker, m_tokenizer.shouldAllowCDATA())))
-                m_xssAuditorDelegate.didBlockScript(*xssInfo);
-        }
-
</del><span class="cx">         constructTreeFromHTMLToken(token);
</span><span class="cx">     } while (!isStopped());
</span><span class="cx"> 
</span><span class="lines">@@ -309,8 +300,6 @@
</span><span class="cx"> 
</span><span class="cx">     PumpSession session(m_pumpSessionNestingLevel, contextForParsingSession());
</span><span class="cx"> 
</span><del>-    m_xssAuditor.init(document(), &m_xssAuditorDelegate);
-
</del><span class="cx">     auto emitTracePoint = [this](TracePointCode code) {
</span><span class="cx">         if (!m_shouldEmitTracePoints)
</span><span class="cx">             return;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlparserHTMLDocumentParserh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/parser/HTMLDocumentParser.h (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/HTMLDocumentParser.h    2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/html/parser/HTMLDocumentParser.h       2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
</span><del>- * Copyright (C) 2015 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2015-2021 Apple Inc. All Rights Reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -32,8 +32,6 @@
</span><span class="cx"> #include "HTMLTokenizer.h"
</span><span class="cx"> #include "PendingScriptClient.h"
</span><span class="cx"> #include "ScriptableDocumentParser.h"
</span><del>-#include "XSSAuditor.h"
-#include "XSSAuditorDelegate.h"
</del><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><span class="lines">@@ -136,8 +134,6 @@
</span><span class="cx">     std::unique_ptr<HTMLParserScheduler> m_parserScheduler;
</span><span class="cx">     HTMLSourceTracker m_sourceTracker;
</span><span class="cx">     TextPosition m_textPosition;
</span><del>-    XSSAuditor m_xssAuditor;
-    XSSAuditorDelegate m_xssAuditorDelegate;
</del><span class="cx"> 
</span><span class="cx">     std::unique_ptr<HTMLResourcePreloader> m_preloader;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlparserHTMLTokenh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/parser/HTMLToken.h (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/HTMLToken.h     2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/html/parser/HTMLToken.h        2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2013 Google, Inc. All Rights Reserved.
</span><del>- * Copyright (C) 2015 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2015-2021 Apple Inc. All Rights Reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -117,8 +117,6 @@
</span><span class="cx">     void setAttributeBaseOffset(unsigned attributeBaseOffset) { m_attributeBaseOffset = attributeBaseOffset; }
</span><span class="cx"> 
</span><span class="cx"> public:
</span><del>-    // Used by the XSSAuditor to nuke XSS-laden attributes.
-    void eraseValueOfAttribute(unsigned index);
</del><span class="cx">     void appendToAttributeValue(unsigned index, StringView value);
</span><span class="cx"> 
</span><span class="cx">     // Character.
</span><span class="lines">@@ -361,14 +359,6 @@
</span><span class="cx">     return m_attributes;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-// Used by the XSSAuditor to nuke XSS-laden attributes.
-inline void HTMLToken::eraseValueOfAttribute(unsigned i)
-{
-    ASSERT(m_type == StartTag || m_type == EndTag);
-    ASSERT(i < m_attributes.size());
-    m_attributes[i].value.clear();
-}
-
</del><span class="cx"> inline const HTMLToken::DataVector& HTMLToken::characters() const
</span><span class="cx"> {
</span><span class="cx">     ASSERT(m_type == Character);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlparserXSSAuditorcpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/WebCore/html/parser/XSSAuditor.cpp (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/XSSAuditor.cpp  2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/html/parser/XSSAuditor.cpp     2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,752 +0,0 @@
</span><del>-/*
- * Copyright (C) 2011 Adam Barth. All Rights Reserved.
- * Copyright (C) 2011 Daniel Bates (dbates@intudata.com).
- * Copyright (C) 2017 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "XSSAuditor.h"
-
-#include "DecodeEscapeSequences.h"
-#include "Document.h"
-#include "DocumentLoader.h"
-#include "FormData.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "HTMLDocumentParser.h"
-#include "HTMLNames.h"
-#include "HTMLParamElement.h"
-#include "HTMLParserIdioms.h"
-#include "MixedContentChecker.h"
-#include "SVGNames.h"
-#include "Settings.h"
-#include "TextResourceDecoder.h"
-#include "XLinkNames.h"
-#include <wtf/ASCIICType.h>
-#include <wtf/MainThread.h>
-#include <wtf/NeverDestroyed.h>
-#include <wtf/text/StringConcatenateNumbers.h>
-
-namespace WebCore {
-
-using namespace HTMLNames;
-
-static bool isNonCanonicalCharacter(UChar c)
-{
-    // We remove all non-ASCII characters, including non-printable ASCII characters.
-    //
-    // Note, we don't remove backslashes like PHP stripslashes(), which among other things converts "\\0" to the \0 character.
-    // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the
-    // adverse effect that we remove any legitimate zeros from a string.
-    // We also remove forward-slash, because it is common for some servers to collapse successive path components, eg,
-    // a//b becomes a/b.
-    //
-    // For instance: new String("http://localhost:8000") => new String("http:localhost:8").
-    return (c == '\\' || c == '0' || c == '\0' || c == '/' || c >= 127);
-}
-
-static bool isRequiredForInjection(UChar c)
-{
-    return (c == '\'' || c == '"' || c == '<' || c == '>');
-}
-
-static bool isTerminatingCharacter(UChar c)
-{
-    return (c == '&' || c == '/' || c == '"' || c == '\'' || c == '<' || c == '>' || c == ',');
-}
-
-static bool isHTMLQuote(UChar c)
-{
-    return (c == '"' || c == '\'');
-}
-
-static bool isJSNewline(UChar c)
-{
-    // Per ecma-262 section 7.3 Line Terminators.
-    return (c == '\n' || c == '\r' || c == 0x2028 || c == 0x2029);
-}
-
-static bool startsHTMLCommentAt(const String& string, size_t start)
-{
-    return (start + 3 < string.length() && string[start] == '<' && string[start + 1] == '!' && string[start + 2] == '-' && string[start + 3] == '-');
-}
-
-static bool startsSingleLineCommentAt(const String& string, size_t start)
-{
-    return (start + 1 < string.length() && string[start] == '/' && string[start + 1] == '/');
-}
-
-static bool startsMultiLineCommentAt(const String& string, size_t start)
-{
-    return (start + 1 < string.length() && string[start] == '/' && string[start + 1] == '*');
-}
-
-static bool startsOpeningScriptTagAt(const String& string, size_t start)
-{
-    return start + 6 < string.length() && string[start] == '<'
-        && WTF::toASCIILowerUnchecked(string[start + 1]) == 's'
-        && WTF::toASCIILowerUnchecked(string[start + 2]) == 'c'
-        && WTF::toASCIILowerUnchecked(string[start + 3]) == 'r'
-        && WTF::toASCIILowerUnchecked(string[start + 4]) == 'i'
-        && WTF::toASCIILowerUnchecked(string[start + 5]) == 'p'
-        && WTF::toASCIILowerUnchecked(string[start + 6]) == 't';
-}
-
-// If other files need this, we should move this to HTMLParserIdioms.h
-template<size_t inlineCapacity>
-bool threadSafeMatch(const Vector<UChar, inlineCapacity>& vector, const QualifiedName& qname)
-{
-    return equalIgnoringNullity(vector, qname.localName().impl());
-}
-
-static bool hasName(const HTMLToken& token, const QualifiedName& name)
-{
-    return threadSafeMatch(token.name(), name);
-}
-
-static bool findAttributeWithName(const HTMLToken& token, const QualifiedName& name, size_t& indexOfMatchingAttribute)
-{
-    // Notice that we're careful not to ref the StringImpl here because we might be on a background thread.
-    const String& attrName = name.namespaceURI() == XLinkNames::xlinkNamespaceURI ? "xlink:" + name.localName().string() : name.localName().string();
-
-    for (size_t i = 0; i < token.attributes().size(); ++i) {
-        if (equalIgnoringNullity(token.attributes().at(i).name, attrName)) {
-            indexOfMatchingAttribute = i;
-            return true;
-        }
-    }
-    return false;
-}
-
-static bool isNameOfInlineEventHandler(const Vector<UChar, 32>& name)
-{
-    const size_t lengthOfShortestInlineEventHandlerName = 5; // To wit: oncut.
-    if (name.size() < lengthOfShortestInlineEventHandlerName)
-        return false;
-    return name[0] == 'o' && name[1] == 'n';
-}
-
-static bool isDangerousHTTPEquiv(const String& value)
-{
-    String equiv = value.stripWhiteSpace();
-    return equalLettersIgnoringASCIICase(equiv, "refresh");
-}
-
-static inline String decode16BitUnicodeEscapeSequences(const String& string)
-{
-    // Note, the encoding is ignored since each %u-escape sequence represents a UTF-16 code unit.
-    return decodeEscapeSequences<Unicode16BitEscapeSequence>(string, UTF8Encoding());
-}
-
-static inline String decodeStandardURLEscapeSequences(const String& string, const TextEncoding& encoding)
-{
-    // We use decodeEscapeSequences() instead of decodeURLEscapeSequences() (declared in URL.h) to
-    // avoid platform-specific URL decoding differences (e.g. URLGoogle).
-    return decodeEscapeSequences<URLEscapeSequence>(string, encoding);
-}
-
-static String fullyDecodeString(const String& string, const TextEncoding& encoding)
-{
-    size_t oldWorkingStringLength;
-    String workingString = string;
-    do {
-        oldWorkingStringLength = workingString.length();
-        workingString = decode16BitUnicodeEscapeSequences(decodeStandardURLEscapeSequences(workingString, encoding));
-    } while (workingString.length() < oldWorkingStringLength);
-    workingString.replace('+', ' ');
-    return workingString;
-}
-
-static void truncateForSrcLikeAttribute(String& decodedSnippet)
-{
-    // In HTTP URLs, characters following the first ?, #, or third slash may come from
-    // the page itself and can be merely ignored by an attacker's server when a remote
-    // script or script-like resource is requested. In data URLs, the payload starts at
-    // the first comma, and the first /*, //, or <!-- may introduce a comment. Also
-    // data URLs may use the same string literal tricks as with script content itself.
-    // In either case, content following this may come from the page and may be ignored
-    // when the script is executed. Also, any of these characters may now be represented
-    // by the (enlarged) set of HTML5 entities.
-    // For simplicity, we don't differentiate based on URL scheme, and stop at the first
-    // & (since it might be part of an entity for any of the subsequent punctuation)
-    // the first # or ?, the third slash, or the first slash, <, ', or " once a comma
-    // is seen.
-    int slashCount = 0;
-    bool commaSeen = false;
-    for (size_t currentLength = 0; currentLength < decodedSnippet.length(); ++currentLength) {
-        UChar currentChar = decodedSnippet[currentLength];
-        if (currentChar == '&'
-            || currentChar == '?'
-            || currentChar == '#'
-            || ((currentChar == '/' || currentChar == '\\') && (commaSeen || ++slashCount > 2))
-            || (currentChar == '<' && commaSeen)
-            || (currentChar == '\'' && commaSeen)
-            || (currentChar == '"' && commaSeen)) {
-            decodedSnippet.truncate(currentLength);
-            return;
-        }
-        if (currentChar == ',')
-            commaSeen = true;
-    }
-}
-
-static void truncateForScriptLikeAttribute(String& decodedSnippet)
-{
-    // Beware of trailing characters which came from the page itself, not the
-    // injected vector. Excluding the terminating character covers common cases
-    // where the page immediately ends the attribute, but doesn't cover more
-    // complex cases where there is other page data following the injection.
-    // Generally, these won't parse as JavaScript, so the injected vector
-    // typically excludes them from consideration via a single-line comment or
-    // by enclosing them in a string literal terminated later by the page's own
-    // closing punctuation. Since the snippet has not been parsed, the vector
-    // may also try to introduce these via entities. As a result, we'd like to
-    // stop before the first "//", the first <!--, the first entity, or the first
-    // quote not immediately following the first equals sign (taking whitespace
-    // into consideration). To keep things simpler, we don't try to distinguish
-    // between entity-introducing ampersands vs. other uses, nor do we bother to
-    // check for a second slash for a comment, nor do we bother to check for
-    // !-- following a less-than sign. We stop instead on any ampersand
-    // slash, or less-than sign.
-    size_t position = 0;
-    if ((position = decodedSnippet.find('=')) != notFound
-        && (position = decodedSnippet.find(isNotHTMLSpace<UChar>, position + 1)) != notFound
-        && (position = decodedSnippet.find(isTerminatingCharacter, isHTMLQuote(decodedSnippet[position]) ? position + 1 : position)) != notFound) {
-        decodedSnippet.truncate(position);
-    }
-}
-
-static bool isSemicolonSeparatedAttribute(const HTMLToken::Attribute& attribute)
-{
-    return threadSafeMatch(attribute.name, SVGNames::valuesAttr);
-}
-
-static bool semicolonSeparatedValueContainsJavaScriptURL(StringView semicolonSeparatedValue)
-{
-    for (auto value : semicolonSeparatedValue.split(';')) {
-        if (WTF::protocolIsJavaScript(value))
-            return true;
-    }
-    return false;
-}
-
-XSSAuditor::XSSAuditor()
-    : m_isEnabled(false)
-    , m_xssProtection(XSSProtectionDisposition::Enabled)
-    , m_didSendValidXSSProtectionHeader(false)
-    , m_state(Uninitialized)
-    , m_scriptTagNestingLevel(0)
-    , m_encoding(UTF8Encoding())
-{
-    // Although tempting to call init() at this point, the various objects
-    // we want to reference might not all have been constructed yet.
-}
-
-void XSSAuditor::initForFragment()
-{
-    ASSERT(isMainThread());
-    ASSERT(m_state == Uninitialized);
-    m_state = Initialized;
-    // When parsing a fragment, we don't enable the XSS auditor because it's
-    // too much overhead.
-    ASSERT(!m_isEnabled);
-}
-
-void XSSAuditor::init(Document* document, XSSAuditorDelegate* auditorDelegate)
-{
-    ASSERT(isMainThread());
-    if (m_state == Initialized)
-        return;
-    ASSERT(m_state == Uninitialized);
-    m_state = Initialized;
-
-    if (RefPtr<Frame> frame = document->frame())
-        m_isEnabled = frame->settings().xssAuditorEnabled();
-
-    if (!m_isEnabled)
-        return;
-
-    m_documentURL = document->url().isolatedCopy();
-
-    // In theory, the Document could have detached from the Frame after the
-    // XSSAuditor was constructed.
-    if (!document->frame()) {
-        m_isEnabled = false;
-        return;
-    }
-
-    if (m_documentURL.isEmpty()) {
-        // The URL can be empty when opening a new browser window or calling window.open("").
-        m_isEnabled = false;
-        return;
-    }
-
-    if (m_documentURL.protocolIsData()) {
-        m_isEnabled = false;
-        return;
-    }
-
-    if (document->decoder())
-        m_encoding = document->decoder()->encoding();
-
-    m_decodedURL = canonicalize(m_documentURL.string(), TruncationStyle::None);
-    if (m_decodedURL.find(isRequiredForInjection) == notFound)
-        m_decodedURL = String();
-
-    if (RefPtr<DocumentLoader> documentLoader = document->frame()->loader().documentLoader()) {
-        String headerValue = documentLoader->response().httpHeaderField(HTTPHeaderName::XXSSProtection);
-        String errorDetails;
-        unsigned errorPosition = 0;
-        String parsedReportURL;
-        URL reportURL;
-        m_xssProtection = parseXSSProtectionHeader(headerValue, errorDetails, errorPosition, parsedReportURL);
-        m_didSendValidXSSProtectionHeader = !headerValue.isNull() && m_xssProtection != XSSProtectionDisposition::Invalid;
-
-        if ((m_xssProtection == XSSProtectionDisposition::Enabled || m_xssProtection == XSSProtectionDisposition::BlockEnabled) && !parsedReportURL.isEmpty()) {
-            reportURL = document->completeURL(parsedReportURL);
-            if (MixedContentChecker::isMixedContent(document->securityOrigin(), reportURL)) {
-                errorDetails = "insecure reporting URL for secure page";
-                m_xssProtection = XSSProtectionDisposition::Invalid;
-                reportURL = URL();
-                m_didSendValidXSSProtectionHeader = false;
-            }
-        }
-        if (m_xssProtection == XSSProtectionDisposition::Invalid) {
-            document->addConsoleMessage(MessageSource::Security, MessageLevel::Error, makeString("Error parsing header X-XSS-Protection: ", headerValue, ": ", errorDetails, " at character position ", errorPosition, ". The default protections will be applied."));
-            m_xssProtection = XSSProtectionDisposition::Enabled;
-        }
-
-        if (auditorDelegate)
-            auditorDelegate->setReportURL(reportURL.isolatedCopy());
-        RefPtr<FormData> httpBody = documentLoader->originalRequest().httpBody();
-        if (httpBody && !httpBody->isEmpty()) {
-            String httpBodyAsString = httpBody->flattenToString();
-            if (!httpBodyAsString.isEmpty()) {
-                m_decodedHTTPBody = canonicalize(httpBodyAsString, TruncationStyle::None);
-                if (m_decodedHTTPBody.find(isRequiredForInjection) == notFound)
-                    m_decodedHTTPBody = String();
-            }
-        }
-    }
-
-    if (m_decodedURL.isEmpty() && m_decodedHTTPBody.isEmpty()) {
-        m_isEnabled = false;
-        return;
-    }
-}
-
-std::unique_ptr<XSSInfo> XSSAuditor::filterToken(const FilterTokenRequest& request)
-{
-    ASSERT(m_state == Initialized);
-    if (!m_isEnabled || m_xssProtection == XSSProtectionDisposition::Disabled)
-        return nullptr;
-
-    bool didBlockScript = false;
-    if (request.token.type() == HTMLToken::StartTag)
-        didBlockScript = filterStartToken(request);
-    else if (m_scriptTagNestingLevel) {
-        if (request.token.type() == HTMLToken::Character)
-            didBlockScript = filterCharacterToken(request);
-        else if (request.token.type() == HTMLToken::EndTag)
-            filterEndToken(request);
-    }
-
-    if (!didBlockScript)
-        return nullptr;
-
-    bool didBlockEntirePage = m_xssProtection == XSSProtectionDisposition::BlockEnabled;
-    return makeUnique<XSSInfo>(m_documentURL.string(), didBlockEntirePage, m_didSendValidXSSProtectionHeader);
-}
-
-bool XSSAuditor::filterStartToken(const FilterTokenRequest& request)
-{
-    bool didBlockScript = eraseDangerousAttributesIfInjected(request);
-
-    if (hasName(request.token, scriptTag)) {
-        didBlockScript |= filterScriptToken(request);
-        ASSERT(request.shouldAllowCDATA || !m_scriptTagNestingLevel);
-        m_scriptTagNestingLevel++;
-    } else if (hasName(request.token, objectTag))
-        didBlockScript |= filterObjectToken(request);
-    else if (hasName(request.token, paramTag))
-        didBlockScript |= filterParamToken(request);
-    else if (hasName(request.token, embedTag))
-        didBlockScript |= filterEmbedToken(request);
-    else if (hasName(request.token, appletTag))
-        didBlockScript |= filterAppletToken(request);
-    else if (hasName(request.token, iframeTag) || hasName(request.token, frameTag))
-        didBlockScript |= filterFrameToken(request);
-    else if (hasName(request.token, metaTag))
-        didBlockScript |= filterMetaToken(request);
-    else if (hasName(request.token, baseTag))
-        didBlockScript |= filterBaseToken(request);
-    else if (hasName(request.token, formTag))
-        didBlockScript |= filterFormToken(request);
-    else if (hasName(request.token, inputTag))
-        didBlockScript |= filterInputToken(request);
-    else if (hasName(request.token, buttonTag))
-        didBlockScript |= filterButtonToken(request);
-
-    return didBlockScript;
-}
-
-void XSSAuditor::filterEndToken(const FilterTokenRequest& request)
-{
-    ASSERT(m_scriptTagNestingLevel);
-    if (hasName(request.token, scriptTag)) {
-        m_scriptTagNestingLevel--;
-        ASSERT(request.shouldAllowCDATA || !m_scriptTagNestingLevel);
-    }
-}
-
-bool XSSAuditor::filterCharacterToken(const FilterTokenRequest& request)
-{
-    ASSERT(m_scriptTagNestingLevel);
-    if (m_wasScriptTagFoundInRequest && isContainedInRequest(canonicalizedSnippetForJavaScript(request))) {
-        request.token.clear();
-        LChar space = ' ';
-        request.token.appendToCharacter(space); // Technically, character tokens can't be empty.
-        return true;
-    }
-    return false;
-}
-
-bool XSSAuditor::filterScriptToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, scriptTag));
-
-    m_wasScriptTagFoundInRequest = isContainedInRequest(canonicalizedSnippetForTagName(request));
-
-    bool didBlockScript = false;
-    if (m_wasScriptTagFoundInRequest) {
-        didBlockScript |= eraseAttributeIfInjected(request, srcAttr, aboutBlankURL().string(), TruncationStyle::SrcLikeAttribute);
-        didBlockScript |= eraseAttributeIfInjected(request, SVGNames::hrefAttr, aboutBlankURL().string(), TruncationStyle::SrcLikeAttribute);
-        didBlockScript |= eraseAttributeIfInjected(request, XLinkNames::hrefAttr, aboutBlankURL().string(), TruncationStyle::SrcLikeAttribute);
-    }
-
-    return didBlockScript;
-}
-
-bool XSSAuditor::filterObjectToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, objectTag));
-
-    bool didBlockScript = false;
-    if (isContainedInRequest(canonicalizedSnippetForTagName(request))) {
-        didBlockScript |= eraseAttributeIfInjected(request, dataAttr, aboutBlankURL().string(), TruncationStyle::SrcLikeAttribute);
-        didBlockScript |= eraseAttributeIfInjected(request, typeAttr);
-        didBlockScript |= eraseAttributeIfInjected(request, classidAttr);
-    }
-    return didBlockScript;
-}
-
-bool XSSAuditor::filterParamToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, paramTag));
-
-    size_t indexOfNameAttribute;
-    if (!findAttributeWithName(request.token, nameAttr, indexOfNameAttribute))
-        return false;
-
-    const HTMLToken::Attribute& nameAttribute = request.token.attributes().at(indexOfNameAttribute);
-    if (!HTMLParamElement::isURLParameter(String(nameAttribute.value)))
-        return false;
-
-    return eraseAttributeIfInjected(request, valueAttr, aboutBlankURL().string(), TruncationStyle::SrcLikeAttribute);
-}
-
-bool XSSAuditor::filterEmbedToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, embedTag));
-
-    bool didBlockScript = false;
-    if (isContainedInRequest(canonicalizedSnippetForTagName(request))) {
-        didBlockScript |= eraseAttributeIfInjected(request, codeAttr, String(), TruncationStyle::SrcLikeAttribute);
-        didBlockScript |= eraseAttributeIfInjected(request, srcAttr, aboutBlankURL().string(), TruncationStyle::SrcLikeAttribute);
-        didBlockScript |= eraseAttributeIfInjected(request, typeAttr);
-    }
-    return didBlockScript;
-}
-
-bool XSSAuditor::filterAppletToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, appletTag));
-
-    bool didBlockScript = false;
-    if (isContainedInRequest(canonicalizedSnippetForTagName(request))) {
-        didBlockScript |= eraseAttributeIfInjected(request, codeAttr, String(), TruncationStyle::SrcLikeAttribute);
-        didBlockScript |= eraseAttributeIfInjected(request, objectAttr);
-    }
-    return didBlockScript;
-}
-
-bool XSSAuditor::filterFrameToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, iframeTag) || hasName(request.token, frameTag));
-
-    bool didBlockScript = eraseAttributeIfInjected(request, srcdocAttr, String(), TruncationStyle::ScriptLikeAttribute);
-    if (isContainedInRequest(canonicalizedSnippetForTagName(request)))
-        didBlockScript |= eraseAttributeIfInjected(request, srcAttr, String(), TruncationStyle::SrcLikeAttribute);
-
-    return didBlockScript;
-}
-
-bool XSSAuditor::filterMetaToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, metaTag));
-
-    return eraseAttributeIfInjected(request, http_equivAttr);
-}
-
-bool XSSAuditor::filterBaseToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, baseTag));
-
-    return eraseAttributeIfInjected(request, hrefAttr);
-}
-
-bool XSSAuditor::filterFormToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, formTag));
-
-    return eraseAttributeIfInjected(request, actionAttr, aboutBlankURL().string());
-}
-
-bool XSSAuditor::filterInputToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, inputTag));
-
-    return eraseAttributeIfInjected(request, formactionAttr, aboutBlankURL().string(), TruncationStyle::SrcLikeAttribute);
-}
-
-bool XSSAuditor::filterButtonToken(const FilterTokenRequest& request)
-{
-    ASSERT(request.token.type() == HTMLToken::StartTag);
-    ASSERT(hasName(request.token, buttonTag));
-
-    return eraseAttributeIfInjected(request, formactionAttr, aboutBlankURL().string(), TruncationStyle::SrcLikeAttribute);
-}
-
-bool XSSAuditor::eraseDangerousAttributesIfInjected(const FilterTokenRequest& request)
-{
-    static NeverDestroyed<String> safeJavaScriptURL(MAKE_STATIC_STRING_IMPL("javascript:void(0)"));
-
-    bool didBlockScript = false;
-    for (size_t i = 0; i < request.token.attributes().size(); ++i) {
-        const HTMLToken::Attribute& attribute = request.token.attributes().at(i);
-        bool isInlineEventHandler = isNameOfInlineEventHandler(attribute.name);
-        // FIXME: It would be better if we didn't create a new String for every attribute in the document.
-        String strippedValue = stripLeadingAndTrailingHTMLSpaces(String(attribute.value));
-        bool valueContainsJavaScriptURL = (!isInlineEventHandler && WTF::protocolIsJavaScript(strippedValue)) || (isSemicolonSeparatedAttribute(attribute) && semicolonSeparatedValueContainsJavaScriptURL(strippedValue));
-        if (!isInlineEventHandler && !valueContainsJavaScriptURL)
-            continue;
-        if (!isContainedInRequest(canonicalize(snippetFromAttribute(request, attribute), TruncationStyle::ScriptLikeAttribute)))
-            continue;
-        request.token.eraseValueOfAttribute(i);
-        if (valueContainsJavaScriptURL)
-            request.token.appendToAttributeValue(i, safeJavaScriptURL.get());
-        didBlockScript = true;
-    }
-    return didBlockScript;
-}
-
-bool XSSAuditor::eraseAttributeIfInjected(const FilterTokenRequest& request, const QualifiedName& attributeName, const String& replacementValue, TruncationStyle truncationStyle)
-{
-    size_t indexOfAttribute = 0;
-    if (!findAttributeWithName(request.token, attributeName, indexOfAttribute))
-        return false;
-
-    const HTMLToken::Attribute& attribute = request.token.attributes().at(indexOfAttribute);
-    if (!isContainedInRequest(canonicalize(snippetFromAttribute(request, attribute), truncationStyle)))
-        return false;
-
-    if (threadSafeMatch(attributeName, srcAttr)) {
-        if (isLikelySafeResource(String(attribute.value)))
-            return false;
-    } else if (threadSafeMatch(attributeName, http_equivAttr)) {
-        if (!isDangerousHTTPEquiv(String(attribute.value)))
-            return false;
-    }
-
-    request.token.eraseValueOfAttribute(indexOfAttribute);
-    if (!replacementValue.isEmpty())
-        request.token.appendToAttributeValue(indexOfAttribute, replacementValue);
-    return true;
-}
-
-String XSSAuditor::canonicalizedSnippetForTagName(const FilterTokenRequest& request)
-{
-    // Grab a fixed number of characters equal to the length of the token's name plus one (to account for the "<").
-    return canonicalize(request.sourceTracker.source(request.token).substring(0, request.token.name().size() + 1), TruncationStyle::None);
-}
-
-String XSSAuditor::snippetFromAttribute(const FilterTokenRequest& request, const HTMLToken::Attribute& attribute)
-{
-    // The range doesn't include the character which terminates the value. So,
-    // for an input of |name="value"|, the snippet is |name="value|. For an
-    // unquoted input of |name=value |, the snippet is |name=value|.
-    // FIXME: We should grab one character before the name also.
-    return request.sourceTracker.source(request.token, attribute.startOffset, attribute.endOffset);
-}
-
-String XSSAuditor::canonicalize(const String& snippet, TruncationStyle truncationStyle)
-{
-    String decodedSnippet = fullyDecodeString(snippet, m_encoding);
-    if (truncationStyle != TruncationStyle::None) {
-        decodedSnippet.truncate(kMaximumFragmentLengthTarget);
-        if (truncationStyle == TruncationStyle::SrcLikeAttribute)
-            truncateForSrcLikeAttribute(decodedSnippet);
-        else if (truncationStyle == TruncationStyle::ScriptLikeAttribute)
-            truncateForScriptLikeAttribute(decodedSnippet);
-    }
-    return decodedSnippet.removeCharacters(&isNonCanonicalCharacter);
-}
-
-String XSSAuditor::canonicalizedSnippetForJavaScript(const FilterTokenRequest& request)
-{
-    String string = request.sourceTracker.source(request.token);
-    size_t startPosition = 0;
-    size_t endPosition = string.length();
-    size_t foundPosition = notFound;
-    size_t lastNonSpacePosition = notFound;
-
-    // Skip over initial comments to find start of code.
-    while (startPosition < endPosition) {
-        while (startPosition < endPosition && isHTMLSpace(string[startPosition]))
-            startPosition++;
-
-        // Under SVG/XML rules, only HTML comment syntax matters and the parser returns
-        // these as a separate comment tokens. Having consumed whitespace, we need not look
-        // further for these.
-        if (request.shouldAllowCDATA)
-            break;
-
-        // Under HTML rules, both the HTML and JS comment synatx matters, and the HTML
-        // comment ends at the end of the line, not with -->.
-        if (startsHTMLCommentAt(string, startPosition) || startsSingleLineCommentAt(string, startPosition)) {
-            while (startPosition < endPosition && !isJSNewline(string[startPosition]))
-                startPosition++;
-        } else if (startsMultiLineCommentAt(string, startPosition)) {
-            if (startPosition + 2 < endPosition && (foundPosition = string.find("*/", startPosition + 2)) != notFound)
-                startPosition = foundPosition + 2;
-            else
-                startPosition = endPosition;
-        } else
-            break;
-    }
-
-    String result;
-    while (startPosition < endPosition && !result.length()) {
-        // Stop at next comment (using the same rules as above for SVG/XML vs HTML), when we encounter a comma,
-        // when we hit an opening <script> tag, or when we exceed the maximum length target. The comma rule
-        // covers a common parameter concatenation case performed by some web servers.
-        lastNonSpacePosition = notFound;
-        for (foundPosition = startPosition; foundPosition < endPosition; foundPosition++) {
-            if (!request.shouldAllowCDATA) {
-                if (startsSingleLineCommentAt(string, foundPosition)
-                    || startsMultiLineCommentAt(string, foundPosition)
-                    || startsHTMLCommentAt(string, foundPosition)) {
-                    break;
-                }
-            }
-            if (string[foundPosition] == ',')
-                break;
-
-            if (lastNonSpacePosition != notFound && startsOpeningScriptTagAt(string, foundPosition)) {
-                foundPosition = lastNonSpacePosition + 1;
-                break;
-            }
-            if (foundPosition > startPosition + kMaximumFragmentLengthTarget) {
-                // After hitting the length target, we can only stop at a point where we know we are
-                // not in the middle of a %-escape sequence. For the sake of simplicity, approximate
-                // not stopping inside a (possibly multiply encoded) %-escape sequence by breaking on
-                // whitespace only. We should have enough text in these cases to avoid false positives.
-                if (isHTMLSpace(string[foundPosition]))
-                    break;
-            }
-
-            if (!isHTMLSpace(string[foundPosition]))
-                lastNonSpacePosition = foundPosition;
-        }
-
-        result = canonicalize(string.substring(startPosition, foundPosition - startPosition), TruncationStyle::None);
-        startPosition = foundPosition + 1;
-    }
-    return result;
-}
-
-SuffixTree<ASCIICodebook>* XSSAuditor::decodedHTTPBodySuffixTree()
-{
-    const unsigned minimumLengthForSuffixTree = 512; // FIXME: Tune this parameter.
-    const unsigned suffixTreeDepth = 5;
-
-    if (!m_decodedHTTPBodySuffixTree && m_decodedHTTPBody.length() >= minimumLengthForSuffixTree)
-        m_decodedHTTPBodySuffixTree = makeUnique<SuffixTree<ASCIICodebook>>(m_decodedHTTPBody, suffixTreeDepth);
-    return m_decodedHTTPBodySuffixTree.get();
-}
-
-bool XSSAuditor::isContainedInRequest(const String& decodedSnippet)
-{
-    if (decodedSnippet.isEmpty())
-        return false;
-    if (m_decodedURL.containsIgnoringASCIICase(decodedSnippet))
-        return true;
-    auto* decodedHTTPBodySuffixTree = this->decodedHTTPBodySuffixTree();
-    if (decodedHTTPBodySuffixTree && !decodedHTTPBodySuffixTree->mightContain(decodedSnippet))
-        return false;
-    return m_decodedHTTPBody.containsIgnoringASCIICase(decodedSnippet);
-}
-
-bool XSSAuditor::isLikelySafeResource(const String& url)
-{
-    // Give empty URLs and about:blank a pass. Making a resourceURL from an
-    // empty string below will likely later fail the "no query args test" as
-    // it inherits the document's query args.
-    if (url.isEmpty() || url == aboutBlankURL().string())
-        return true;
-
-    // If the resource is loaded from the same host as the enclosing page, it's
-    // probably not an XSS attack, so we reduce false positives by allowing the
-    // request, ignoring scheme and port considerations. If the resource has a
-    // query string, we're more suspicious, however, because that's pretty rare
-    // and the attacker might be able to trick a server-side script into doing
-    // something dangerous with the query string.  
-    if (m_documentURL.host().isEmpty())
-        return false;
-
-    URL resourceURL(m_documentURL, url);
-    return (m_documentURL.host() == resourceURL.host() && resourceURL.query().isEmpty());
-}
-
-} // namespace WebCore
</del></span></pre></div>
<a id="trunkSourceWebCorehtmlparserXSSAuditorh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/WebCore/html/parser/XSSAuditor.h (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/XSSAuditor.h    2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/html/parser/XSSAuditor.h       2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,123 +0,0 @@
</span><del>-/*
- * Copyright (C) 2011 Adam Barth. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#pragma once
-
-#include "HTMLToken.h"
-#include "HTTPParsers.h"
-#include <wtf/URL.h>
-#include "SuffixTree.h"
-#include "TextEncoding.h"
-
-namespace WebCore {
-
-class Document;
-class HTMLDocumentParser;
-class HTMLSourceTracker;
-class XSSInfo;
-class XSSAuditorDelegate;
-
-struct FilterTokenRequest {
-    FilterTokenRequest(HTMLToken& token, HTMLSourceTracker& sourceTracker, bool shouldAllowCDATA)
-        : token(token)
-        , sourceTracker(sourceTracker)
-        , shouldAllowCDATA(shouldAllowCDATA)
-    { }
-
-    HTMLToken& token;
-    HTMLSourceTracker& sourceTracker;
-    bool shouldAllowCDATA;
-};
-
-class XSSAuditor {
-    WTF_MAKE_NONCOPYABLE(XSSAuditor);
-public:
-    XSSAuditor();
-
-    void init(Document*, XSSAuditorDelegate*);
-    void initForFragment();
-
-    std::unique_ptr<XSSInfo> filterToken(const FilterTokenRequest&);
-
-private:
-    static const size_t kMaximumFragmentLengthTarget = 100;
-
-    enum State {
-        Uninitialized,
-        Initialized
-    };
-
-    enum class TruncationStyle {
-        None,
-        NormalAttribute,
-        SrcLikeAttribute,
-        ScriptLikeAttribute
-    };
-
-    bool filterStartToken(const FilterTokenRequest&);
-    void filterEndToken(const FilterTokenRequest&);
-    bool filterCharacterToken(const FilterTokenRequest&);
-    bool filterScriptToken(const FilterTokenRequest&);
-    bool filterObjectToken(const FilterTokenRequest&);
-    bool filterParamToken(const FilterTokenRequest&);
-    bool filterEmbedToken(const FilterTokenRequest&);
-    bool filterAppletToken(const FilterTokenRequest&);
-    bool filterFrameToken(const FilterTokenRequest&);
-    bool filterMetaToken(const FilterTokenRequest&);
-    bool filterBaseToken(const FilterTokenRequest&);
-    bool filterFormToken(const FilterTokenRequest&);
-    bool filterInputToken(const FilterTokenRequest&);
-    bool filterButtonToken(const FilterTokenRequest&);
-
-    bool eraseDangerousAttributesIfInjected(const FilterTokenRequest&);
-    bool eraseAttributeIfInjected(const FilterTokenRequest&, const QualifiedName&, const String& replacementValue = String(), TruncationStyle = TruncationStyle::NormalAttribute);
-
-    String canonicalizedSnippetForTagName(const FilterTokenRequest&);
-    String canonicalizedSnippetForJavaScript(const FilterTokenRequest&);
-    String snippetFromAttribute(const FilterTokenRequest&, const HTMLToken::Attribute&);
-    String canonicalize(const String&, TruncationStyle);
-
-    bool isContainedInRequest(const String&);
-    bool isLikelySafeResource(const String& url);
-
-    SuffixTree<ASCIICodebook>* decodedHTTPBodySuffixTree();
-
-    URL m_documentURL;
-    bool m_isEnabled;
-
-    XSSProtectionDisposition m_xssProtection;
-    bool m_didSendValidXSSProtectionHeader;
-
-    String m_decodedURL;
-    String m_decodedHTTPBody;
-    std::unique_ptr<SuffixTree<ASCIICodebook>> m_decodedHTTPBodySuffixTree;
-
-    State m_state;
-    bool m_wasScriptTagFoundInRequest { false };
-    unsigned m_scriptTagNestingLevel;
-    TextEncoding m_encoding;
-};
-
-} // namespace WebCore
</del></span></pre></div>
<a id="trunkSourceWebCorehtmlparserXSSAuditorDelegatecpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/WebCore/html/parser/XSSAuditorDelegate.cpp (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/XSSAuditorDelegate.cpp  2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/html/parser/XSSAuditorDelegate.cpp     2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,107 +0,0 @@
</span><del>-/*
- * Copyright (C) 2013 Google, Inc. All Rights Reserved.
- * Copyright (C) 2017 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "XSSAuditorDelegate.h"
-
-#include "Document.h"
-#include "DocumentLoader.h"
-#include "FormData.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "FrameLoaderClient.h"
-#include "HTMLParserIdioms.h"
-#include "NavigationScheduler.h"
-#include "PingLoader.h"
-#include <wtf/JSONValues.h>
-#include <wtf/text/CString.h>
-
-namespace WebCore {
-
-using namespace Inspector;
-
-XSSAuditorDelegate::XSSAuditorDelegate(Document& document)
-    : m_document(document)
-{
-    ASSERT(isMainThread());
-}
-
-static inline String buildConsoleError(const XSSInfo& xssInfo)
-{
-    return makeString("The XSS Auditor ",
-        xssInfo.m_didBlockEntirePage ? "blocked access to" : "refused to execute a script in", " '",
-        xssInfo.m_originalURL, "' because ",
-        xssInfo.m_didBlockEntirePage ? "the source code of a script" : "its source code",
-        " was found within the request.",
-        xssInfo.m_didSendXSSProtectionHeader ? " The server sent an 'X-XSS-Protection' header requesting this behavior."
-            : " The auditor was enabled because the server did not send an 'X-XSS-Protection' header.");
-}
-
-Ref<FormData> XSSAuditorDelegate::generateViolationReport(const XSSInfo& xssInfo)
-{
-    ASSERT(isMainThread());
-
-    auto& frameLoader = m_document.frame()->loader();
-    String httpBody;
-    if (frameLoader.documentLoader()) {
-        if (RefPtr formData = frameLoader.documentLoader()->originalRequest().httpBody())
-            httpBody = formData->flattenToString();
-    }
-
-    auto reportDetails = JSON::Object::create();
-    reportDetails->setString("request-url", xssInfo.m_originalURL);
-    reportDetails->setString("request-body", httpBody);
-
-    auto reportObject = JSON::Object::create();
-    reportObject->setObject("xss-report", WTFMove(reportDetails));
-
-    return FormData::create(reportObject->toJSONString().utf8().data());
-}
-
-void XSSAuditorDelegate::didBlockScript(const XSSInfo& xssInfo)
-{
-    ASSERT(isMainThread());
-
-    m_document.addConsoleMessage(MessageSource::JS, MessageLevel::Error, buildConsoleError(xssInfo));
-
-    FrameLoader& frameLoader = m_document.frame()->loader();
-    if (xssInfo.m_didBlockEntirePage)
-        frameLoader.stopAllLoaders();
-
-    if (!m_didSendNotifications) {
-        m_didSendNotifications = true;
-
-        frameLoader.client().didDetectXSS(m_document.url(), xssInfo.m_didBlockEntirePage);
-
-        if (!m_reportURL.isEmpty())
-            PingLoader::sendViolationReport(*m_document.frame(), m_reportURL, generateViolationReport(xssInfo), ViolationReportType::XSSAuditor);
-    }
-
-    if (xssInfo.m_didBlockEntirePage)
-        m_document.frame()->navigationScheduler().schedulePageBlock(m_document);
-}
-
-} // namespace WebCore
</del></span></pre></div>
<a id="trunkSourceWebCorehtmlparserXSSAuditorDelegateh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/WebCore/html/parser/XSSAuditorDelegate.h (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/XSSAuditorDelegate.h    2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/html/parser/XSSAuditorDelegate.h       2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,70 +0,0 @@
</span><del>-/*
- * Copyright (C) 2013 Google, Inc. All Rights Reserved.
- * Copyright (C) 2017 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#pragma once
-
-#include <wtf/URL.h>
-#include <wtf/text/TextPosition.h>
-
-namespace WebCore {
-
-class Document;
-class FormData;
-
-// FIXME: Should change into a struct.
-// FIXME: Should return by value instead of using a unique_ptr.
-class XSSInfo {
-    WTF_MAKE_FAST_ALLOCATED;
-public:
-    XSSInfo(const String& originalURL, bool didBlockEntirePage, bool didSendXSSProtectionHeader)
-        : m_originalURL(originalURL.isolatedCopy())
-        , m_didBlockEntirePage(didBlockEntirePage)
-        , m_didSendXSSProtectionHeader(didSendXSSProtectionHeader)
-    {
-    }
-
-    String m_originalURL;
-    bool m_didBlockEntirePage;
-    bool m_didSendXSSProtectionHeader;
-    TextPosition m_textPosition;
-};
-
-class XSSAuditorDelegate {
-public:
-    explicit XSSAuditorDelegate(Document&);
-
-    void didBlockScript(const XSSInfo&);
-    void setReportURL(const URL& url) { m_reportURL = url; }
-
-private:
-    Ref<FormData> generateViolationReport(const XSSInfo&);
-
-    Document& m_document;
-    bool m_didSendNotifications { false };
-    URL m_reportURL;
-};
-
-} // namespace WebCore
</del></span></pre></div>
<a id="trunkSourceWebCoreloaderPingLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/PingLoader.cpp (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/PingLoader.cpp       2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/loader/PingLoader.cpp  2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2010 Google Inc. All rights reserved.
</span><span class="cx">  * Copyright (C) 2015 Roopesh Chander (roop@roopc.net)
</span><del>- * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions are
</span><span class="lines">@@ -172,9 +172,6 @@
</span><span class="cx">     case ViolationReportType::ContentSecurityPolicy:
</span><span class="cx">         request.setHTTPContentType("application/csp-report"_s);
</span><span class="cx">         break;
</span><del>-    case ViolationReportType::XSSAuditor:
-        request.setHTTPContentType("application/json"_s);
-        break;
</del><span class="cx">     case ViolationReportType::StandardReportingAPIViolation:
</span><span class="cx">         request.setHTTPContentType("application/reports+json"_s);
</span><span class="cx">         break;
</span></span></pre></div>
<a id="trunkSourceWebCoreloaderPingLoaderh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/PingLoader.h (282846 => 282847)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/PingLoader.h 2021-09-21 22:45:40 UTC (rev 282846)
+++ trunk/Source/WebCore/loader/PingLoader.h    2021-09-21 23:02:16 UTC (rev 282847)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2010 Google Inc. All rights reserved.
</span><del>- * Copyright (C) 2017 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2017-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions are
</span><span class="lines">@@ -45,7 +45,6 @@
</span><span class="cx"> 
</span><span class="cx"> enum class ViolationReportType : uint8_t {
</span><span class="cx">     ContentSecurityPolicy,
</span><del>-    XSSAuditor,
</del><span class="cx">     StandardReportingAPIViolation // https://www.w3.org/TR/reporting/#try-delivery
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>