[Webkit-unassigned] [Bug 78836] XSSAuditor bypass with <svg> tags and html-entities.

Thu Feb 16 13:51:13 PST 2012

https://bugs.webkit.org/show_bug.cgi?id=78836


--- Comment #1 from Thomas Sepez <tsepez at chromium.org>  2012-02-16 13:51:12 PST ---
Probably the right way to fix this is for xssauditor to know when it is in an SVG block vs. an ordinary script block, and apply html entity decoding to match the HTML vs. XML expectations.  Trying to always html entity decode will open up vulns in the HTML case.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.