[Webkit-unassigned] [Bug 27895] [XSSAuditor] Inline Event Handler with single-line JavaScript comment can bypass XSSAuditor

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=27895


Daniel Bates <dbates at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #33902|0                           |1
        is obsolete|                            |




--- Comment #3 from Daniel Bates <dbates at webkit.org>  2009-08-05 13:18:37 PDT ---
Created an attachment (id=34165)
 --> (https://bugs.webkit.org/attachment.cgi?id=34165)
Proposed Patch 1 with HTML Base href fix

This is an updated version of the original proposed patch with base href fix.
I'll file this under a separate bug, but for comparison with the alternative
patch that will follow, I have left this fix in for now.

Also, the change logs in this patch do not reflect the addition of the base
href fix.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.