[Webkit-unassigned] [Bug 27895] [XSSAuditor] Inline Event Handler with single-line JavaScript quote can bypass XSSAuditor
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Jul 31 14:11:39 PDT 2009
https://bugs.webkit.org/show_bug.cgi?id=27895
--- Comment #2 from Adam Barth <abarth at webkit.org> 2009-07-31 14:11:38 PDT ---
Hum... The static_casts (which are really manual dynamic_casts) make me sad.
I think it comes down to what MappedAttribute represents. Can you try working
up a patch that doesn't used MappedAttribute so we can compare? IE8 just
blocks attributes that start with "on" and are at least 5 characters. Also,
you should explain where we came up with the magic constant substring(0, 7).
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list