[Webkit-unassigned] [Bug 27895] [XSSAuditor] Inline Event Handler with single-line JavaScript comment can bypass XSSAuditor

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=27895


Adam Barth <abarth at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #41022|review?                     |review-
               Flag|                            |




--- Comment #21 from Adam Barth <abarth at webkit.org>  2009-10-12 09:24:49 PDT ---
(From update of attachment 41022)
I think there is a subtle bug with this patch.  Imagine that an HTML entity is
straddling the 7th character:

/*xx©*/alert(/xss);

When we substring, we'll get

/*xx&co

and the entity won't decode and the string won't match.

We need to canonicalize() first before calling substring...

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.