[Webkit-unassigned] [Bug 68094] xssauditor - script block ending in comment can bypass auditor.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=68094





--- Comment #16 from Thomas Sepez <tsepez at chromium.org>  2011-09-21 15:15:08 PST ---
<script> <!-- this is a comment                                                 
alert(0) <!-- this may not be a comment                                         
// -->
</script>
<script>a=1;alert("case 1: " + (false<!--a));</script>                          
<script>a=1;alert("case 2: " + (false<! --a));</script>                         
<script>a=1;alert("case 3: " + (false< !--a));</script>                         

gives an alert: 0, syntax error, alert: case2:true, and alert: case3 true.  This implies that <!-- is always a comment.  At least on webkit and FF (6.0.2).

So will fold all those into the loop.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.