Changeset 206277 in webkit

Timestamp:

Sep 22, 2016 2:34:12 PM (8 years ago)

Author:

dbates@webkit.org

Message:

[XSS Auditor] HTML5 entities can bypass XSS Auditor
​https://bugs.webkit.org/show_bug.cgi?id=161939
<rdar://problem/25819815>

Reviewed by David Kilzer.

Source/WebCore:

Merged from Blink:
<​https://chromium.googlesource.com/chromium/src/+/04e44060dccee711842d08652bf1c622a0f43179>

Truncate a src-like URL at the first & character as it may mark the start of an HTML entity.
We will evaluate the effectiveness of this approach and adjust it if necessary if we see an
increase in false positives.

HTML5 defines more named character references, including named character references for common
punctuation characters. Characters following some punctuation characters may come from the page
itself. We truncate src-like strings at punctuation characters to avoid considering such page
content when performing a match.

Test: http/tests/security/xssAuditor/script-tag-with-source-data-url5.html

• html/parser/XSSAuditor.cpp:

(WebCore::truncateForSrcLikeAttribute):

LayoutTests:

• http/tests/security/xssAuditor/script-tag-with-source-data-url5-expected.txt: Added.
• http/tests/security/xssAuditor/script-tag-with-source-data-url5.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-data-url5-expected.txt (added)
• LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-data-url5.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/parser/XSSAuditor.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-09-22  Daniel Bates  <dabates@apple.com>
+
+        [XSS Auditor] HTML5 entities can bypass XSS Auditor
+        https://bugs.webkit.org/show_bug.cgi?id=161939
+        <rdar://problem/25819815>
+
+        Reviewed by David Kilzer.
+
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url5-expected.txt: Added.
+        * http/tests/security/xssAuditor/script-tag-with-source-data-url5.html: Added.
+
 2016-09-22  Daniel Bates  <dabates@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-09-22  Daniel Bates  <dabates@apple.com>
+
+        [XSS Auditor] HTML5 entities can bypass XSS Auditor
+        https://bugs.webkit.org/show_bug.cgi?id=161939
+        <rdar://problem/25819815>
+
+        Reviewed by David Kilzer.
+
+        Merged from Blink:
+        <https://chromium.googlesource.com/chromium/src/+/04e44060dccee711842d08652bf1c622a0f43179>
+
+        Truncate a src-like URL at the first & character as it may mark the start of an HTML entity.
+        We will evaluate the effectiveness of this approach and adjust it if necessary if we see an
+        increase in false positives.
+
+        HTML5 defines more named character references, including named character references for common
+        punctuation characters. Characters following some punctuation characters may come from the page
+        itself. We truncate src-like strings at punctuation characters to avoid considering such page
+        content when performing a match.
+
+        Test: http/tests/security/xssAuditor/script-tag-with-source-data-url5.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::truncateForSrcLikeAttribute):
+
 2016-09-22  Daniel Bates  <dabates@apple.com>
 

trunk/Source/WebCore/html/parser/XSSAuditor.cpp

@@ -183 +183 @@
     // data URLs may use the same string literal tricks as with script content itself.
     // In either case, content following this may come from the page and may be ignored
-    // when the script is executed.
-    // For simplicity, we don't differentiate based on URL scheme, and stop at
+    // when the script is executed. Also, any of these characters may now be represented
+    // by the (enlarged) set of HTML5 entities.
+    // For simplicity, we don't differentiate based on URL scheme, and stop at the first
+    // & (since it might be part of an entity for any of the subsequent punctuation)
     // the first # or ?, the third slash, or the first slash, <, ', or " once a comma
     // is seen.
@@ -191 +193 @@
     for (size_t currentLength = 0; currentLength < decodedSnippet.length(); ++currentLength) {
         UChar currentChar = decodedSnippet[currentLength];
-        if (currentChar == '?'
+        if (currentChar == '&'
+            || currentChar == '?'
             || currentChar == '#'
             || ((currentChar == '/' || currentChar == '\\') && (commaSeen || ++slashCount > 2))