[webkit-dev] XSSAuditor regressions

[Maciej Stachowiak]

Hi everyone,

Recently Adam Barth turned on an exciting new feature, the XSS  
Auditor, by default. This provides a browser-side defense against  
sites that are vulnerable to reflexive XSS attacks. Because this  
feature operates by blocking script execution, it has the potential to  
break legitimate sites via overzealous enforcement. I'd like to ask  
everyone to be on the lookout for these. If a site fails mysteriously,  
especially if it's a regression, check the Web Inspector console for a  
message like "Refused to execute a JavaScript script. Source code of  
script found within request."

I made a new keyword, XSSAuditor, and bugs tagged with XSSAuditor and  
Regression can be assumed to be fallout from the change. You can see  
the current known regressions with this query: <http://tinyurl.com/mw4j3y 
 >. So far, there are two, but they are pretty major (Facebook and  
Outlook Web Access).

Hopefully we can quickly flush out and fix a lot of these false  
positive results, but if the bugs start piling up, it may be wise to  
turn the feature off by default until the initial crop of regressions  
is dealt with, so the nightlies remain usable for testing. (I don't  
think we're at that point yet and Adam seems to be on top of the  
incoming bugs.)

Regards,
Maciej