[Webkit-unassigned] [Bug 27895] [XSSAuditor] Inline Event Handler with single-line JavaScript comment can bypass XSSAuditor
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Sep 25 14:32:34 PDT 2009
https://bugs.webkit.org/show_bug.cgi?id=27895
Daniel Bates <dbates at webkit.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #40145| |review?
Flag| |
Attachment #34166|0 |1
is obsolete| |
Attachment #34165|0 |1
is obsolete| |
--- Comment #8 from Daniel Bates <dbates at webkit.org> 2009-09-25 14:32:33 PDT ---
Created an attachment (id=40145)
--> (https://bugs.webkit.org/attachment.cgi?id=40145)
Patch with test cases
I went with a modified Proposed Patch 1. Instead of defining a new class
MappedAttributeWithRawCharacters and using static_casts, I moved the
functionality I needed into Attribute.h (i.e.
Attribute:rawAttributeBeforeValue() and
Attribute::setRawAttributeBeforeValue(const String& string)). Hence, there are
no static_casts in this patch.
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list