Changeset 100588 in webkit


Ignore:
Timestamp:
Nov 17, 2011 2:10:14 AM (12 years ago)
Author:
apavlov@chromium.org
Message:

Web Inspector: inspector follows javascript: hrefs as relative
​https://bugs.webkit.org/show_bug.cgi?id=72373

Source/WebCore:

javascript: hrefs should never be linkified for security.

Reviewed by Yury Semikhatsky.

  • inspector/front-end/ElementsTreeOutline.js:

(WebInspector.ElementsTreeElement.prototype._buildAttributeDOM):

  • inspector/front-end/ResourceUtils.js:

(WebInspector.completeURL):

LayoutTests:

Reviewed by Yury Semikhatsky.

  • inspector/styles/styles-url-linkify-expected.txt:
  • inspector/styles/styles-url-linkify.html:
Location:
trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r100584 r100588  
     12011-11-16  Alexander Pavlov  <apavlov@chromium.org>
     2
     3        Web Inspector: inspector follows javascript: hrefs as relative
     4        https://bugs.webkit.org/show_bug.cgi?id=72373
     5
     6        Reviewed by Yury Semikhatsky.
     7
     8        * inspector/styles/styles-url-linkify-expected.txt:
     9        * inspector/styles/styles-url-linkify.html:
     10
    1112011-11-17  Dominic Mazzoni  <dmazzoni@google.com>
    212

  • trunk/LayoutTests/inspector/styles/styles-url-linkify-expected.txt

    r90637 r100588  
    1 Tests that URLs are linked to and completed correctly. Bugs 51663, 53171, 62643
     1Tests that URLs are linked to and completed correctly. Bugs 51663, 53171, 62643, 72373
    22
    33
    … …  
    1414http://example.com/foo?a=b
    1515data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEIAAABCAgMAAACeOuh7AAAABGdBTUEAAK/INwWK6QAAAAlQTFRF////AAAA////fu+PTwAAAAF0Uk5TAEDm2GYAAACHSURBVDjLxdLbDYAgDAVQGELn0R3oEHYf2KGdUqtE46OFRCP3oyTng1xCnWsaD5JRRtCkQ2YmkBkHRXqWJBn0j0TICbrsWVoWhRShCdcGyZCtHxMaUnVPRZ9KSbmBJdsX2vJVnwqRD0Rb4rpzgIbE/AI5NTnWAMvy5l0dXrfuLh5OCe5BmmYGXhTUxlQ5xJ8AAAAASUVORK5CYII=
     16javascript:alert('foo');
     17null
    1618Link for a URI from CSS document:
    1719webkit-html-resource-link inspector/styles/resources/fromcss.png

  • trunk/LayoutTests/inspector/styles/styles-url-linkify.html

    r90567 r100588  
    2828    const dataURL = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEIAAABCAgMAAACeOuh7AAAABGdBTUEAAK/INwWK6QAAAAlQTFRF////AAAA////fu+PTwAAAAF0Uk5TAEDm2GYAAACHSURBVDjLxdLbDYAgDAVQGELn0R3oEHYf2KGdUqtE46OFRCP3oyTng1xCnWsaD5JRRtCkQ2YmkBkHRXqWJBn0j0TICbrsWVoWhRShCdcGyZCtHxMaUnVPRZ9KSbmBJdsX2vJVnwqRD0Rb4rpzgIbE/AI5NTnWAMvy5l0dXrfuLh5OCe5BmmYGXhTUxlQ5xJ8AAAAASUVORK5CYII=";
    2929    completeURL("https://example.com/foo", dataURL);
     30    completeURL("http://example.com/foo", "javascript:alert('foo');");
     31    InspectorTest.addResult(WebInspector.resourceURLForRelatedNode(null, " javascript:alert('foo'); "));
    3032
    3133    function dumpHref(dumpLinkClass)
    … …  
    8284<body onload="runAfterIframeIsLoaded()">
    8385<p>
    84 Tests that URLs are linked to and completed correctly. Bugs <a href="http://bugs.webkit.org/show_bug.cgi?id=51663">51663</a>, <a href="http://bugs.webkit.org/show_bug.cgi?id=53171">53171</a>, <a href="http://bugs.webkit.org/show_bug.cgi?id=62643">62643</a>
     86Tests that URLs are linked to and completed correctly. Bugs <a href="http://bugs.webkit.org/show_bug.cgi?id=51663">51663</a>, <a href="http://bugs.webkit.org/show_bug.cgi?id=53171">53171</a>, <a href="http://bugs.webkit.org/show_bug.cgi?id=62643">62643</a>, <a href="http://bugs.webkit.org/show_bug.cgi?id=72373">72373</a>
    8587</p>
    8688<div id="local"></div>

  • trunk/Source/WebCore/ChangeLog

    r100586 r100588  
     12011-11-16  Alexander Pavlov  <apavlov@chromium.org>
     2
     3        Web Inspector: inspector follows javascript: hrefs as relative
     4        https://bugs.webkit.org/show_bug.cgi?id=72373
     5
     6        javascript: hrefs should never be linkified for security.
     7
     8        Reviewed by Yury Semikhatsky.
     9
     10        * inspector/front-end/ElementsTreeOutline.js:
     11        (WebInspector.ElementsTreeElement.prototype._buildAttributeDOM):
     12        * inspector/front-end/ResourceUtils.js:
     13        (WebInspector.completeURL):
     14
    1152011-11-17  Nikolas Zimmermann  <nzimmermann@rim.com>
    216

  • trunk/Source/WebCore/inspector/front-end/ElementsTreeOutline.js

    r99401 r100588  
    14681468            var rewrittenHref = WebInspector.resourceURLForRelatedNode(node, value);
    14691469            value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
    1470             attrSpanElement.appendChild(linkify(rewrittenHref, value, "webkit-html-attribute-value", node.nodeName().toLowerCase() === "a"));
     1470            if (rewrittenHref === null) {
     1471                var attrValueElement = attrSpanElement.createChild("span", "webkit-html-attribute-value");
     1472                attrValueElement.textContent = value;
     1473            } else
     1474                attrSpanElement.appendChild(linkify(rewrittenHref, value, "webkit-html-attribute-value", node.nodeName().toLowerCase() === "a"));
    14711475        } else {
    14721476            value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");

  • trunk/Source/WebCore/inspector/front-end/ResourceUtils.js

    r99849 r100588  
    221221}
    222222
     223/**
     224 * @return {?string} null if the specified resource MUST NOT have a URL (e.g. "javascript:...")
     225 */
    223226WebInspector.resourceURLForRelatedNode = function(node, url)
    224227{
    225228    if (!url || url.indexOf("://") > 0)
    226229        return url;
     230
     231    if (url.trim().indexOf("javascript:") === 0)
     232        return null; // Do not provide a resource URL for security.
    227233
    228234    for (var frameOwnerCandidate = node; frameOwnerCandidate; frameOwnerCandidate = frameOwnerCandidate.parentNode) {
    … …  
    281287        // Return absolute URLs as-is.
    282288        var parsedHref = href.asParsedURL();
    283         if ((parsedHref && parsedHref.scheme) || href.indexOf("data:") === 0)
     289        if (parsedHref && parsedHref.scheme)
     290            return href;
     291
     292        // Return special URLs as-is.
     293        var trimmedHref = href.trim();
     294        if (trimmedHref.indexOf("data:") === 0 || trimmedHref.indexOf("javascript:") === 0)
    284295            return href;
    285296    }
Note: See TracChangeset for help on using the changeset viewer.