[Webkit-unassigned] [Bug 66588] XSS filter bypass via non-standard URL encoding

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=66588





--- Comment #10 from Daniel Bates <dbates at webkit.org>  2011-09-03 22:21:06 PST ---
(In reply to comment #5)
> (From update of attachment 106094 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=106094&action=review
> 
> > Source/WebCore/html/parser/XSSAuditor.cpp:130
> >          workingString = decodeURLEscapeSequences(workingString);
> 
> Might want to circumvent the path through KURL.cpp to avoid schizophrenic issues about whether KURLGoogle.cpp is used on a given build.  You could just call the templated function directly.

Will call templated function decodeEscapeSequences<URLEscapeSequence>() instead of KURL's decodeURLEscapeSequences().

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.