[Webkit-unassigned] [Bug 68094] xssauditor - script block ending in comment can bypass auditor.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=68094





--- Comment #18 from Thomas Sepez <tsepez at chromium.org>  2011-09-21 17:00:13 PST ---
(From update of attachment 108232)
View in context: https://bugs.webkit.org/attachment.cgi?id=108232&action=review

>>> Source/WebCore/html/parser/XSSAuditor.cpp:595
>>> +        endPosition = foundPosition;
>> 
>> We should probably stop at the first <!-- too.  In JavaScript <!-- is just like //.
> 
> Yes, see above.

Argh, as it turns out the 3-arg versions of these calls don't do what I expected them to do.  Will fix this too.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.