[Webkit-unassigned] [Bug 29523] [XSSAuditor] JavaScript URLs that are URL-encoded twice can by bypass the XSSAuditor

Sat Sep 19 15:41:45 PDT 2009

https://bugs.webkit.org/show_bug.cgi?id=29523

Adam Barth <abarth at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #39824|review?                     |review-
               Flag|                            |

--- Comment #2 from Adam Barth <abarth at webkit.org>  2009-09-19 15:41:45 PDT ---
(From update of attachment 39824)
+ m_frame->script()->isEnabled() && !m_frame->script()->isPaused()

Why did we add these conditions that weren't there before?

Can we remove any of the other instances of canEvaluateJavaScriptURL?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.