[Webkit-unassigned] [Bug 26708] XSSAuditor false negatives

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=26708


abarth at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |abarth at webkit.org




------- Comment #2 from abarth at webkit.org  2009-06-26 00:17 PDT -------
In general, we shouldn't be duplicating code from other source files.  You
should modify the other files to expose the functions you need in their header
files.  For example, fixUpChar could be moved to HTMLTokenizer.h (and possibly
renamed) and similarly hexDigitValue.

I also wish we didn't have to write our own XSSAuditor::decodeURLHTMLEntities. 
Does this function not exist elsewhere?  If not, we should add it to the right
file instead of adding it to the auditor directly.  Also for
XSSAuditor::findInRequest, we should only search the parent frame if the
current frame's URL is about:blank.  That should cover the <iframe
src="javascript:..."> case.

Finally, we should do the XSS_AUDITOR_PAGE_HEADERS work in a separate bug /
patch because it's not related to these false negatives.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.