[Webkit-unassigned] [Bug 30241] New: Inconsistent URL encoding/decoding of JavaScript URLs.
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Oct 8 17:12:33 PDT 2009
https://bugs.webkit.org/show_bug.cgi?id=30241
Summary: Inconsistent URL encoding/decoding of JavaScript URLs.
Product: WebKit
Version: 528+ (Nightly build)
Platform: All
OS/Version: All
Status: NEW
Severity: Normal
Priority: P2
Component: WebCore Misc.
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: dbates at webkit.org
CC: sam at webkit.org, abarth at webkit.org
Created an attachment (id=40919)
--> (https://bugs.webkit.org/attachment.cgi?id=40919)
Example
JavaScript URLs that are URL encoded via FrameLoader::completeURL are not
properly decoded before eventually being passed to both the XSSAuditor and
ScriptController::evaluate, because the method KURL::decodeURLEscapeSequences
is NOT the inverse function of KURL::parse().
In particular, this occurs in FrameLoader::requestFrame:
http://trac.webkit.org/browser/trunk/WebCore/loader/FrameLoader.cpp#L348
where the completeURL() is called on |scriptURL| before it is passed to
frame->loader()->executeIfJavaScriptURL().
Remarks:
The call flow of FrameLoader::completeURL is:
FrameLoader::completeURL -> Document::completeURL -> KURL::KURL(const KURL&
base, const String& relative, ...) -> KURL::init - > KURL::parse
The issue is that KURL::parse uses the method KURL::appendEscapingBadChars,
which as its name implies escapes only bad characters.
One such bad character is the space character. Consider the JavaScript URL,
"javascript: '%0A'" (*). Calling KURL::parse on this (directly or implicitly
via one of the functions in the above call chain) will result in a KURL object
that represents the URL, "javascript:%20'%46'" (**). Notice, this result
differs from the fully URL encoded result of "javascript:%20%27%2546%27".
Decoding the string form of (**) using KURL::decodeURLEscapeSequences produces
the result: "javascript: 'F'". Clearly, this is not the inverse of the (**).
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list