[Webkit-unassigned] [Bug 30242] [XSSAuditor] IFrame JavaScript URLs that are URL-encoded twice can by bypass the XSSAuditor

Sun Oct 11 20:21:20 PDT 2009

https://bugs.webkit.org/show_bug.cgi?id=30242

Adam Barth <abarth at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #41007|review?                     |review-
               Flag|                            |

--- Comment #4 from Adam Barth <abarth at webkit.org>  2009-10-11 20:21:20 PDT ---
(From update of attachment 41007)
You need to initialize m_decodeURLEscapeSequencesTwice in the constructor.

At some point we need to clean up all the boolean flags being passed around.

This coding step is getting nasty.  I wish there was a better way.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.