Changeset 66985 in webkit

Timestamp:

Sep 8, 2010 8:18:36 AM (14 years ago)

Author:

commit-queue@webkit.org

Message:

2010-09-08 Sergio Villar Senin <​svillar@igalia.com>

Reviewed by Adam Barth.

Errors in LayoutTests/http/tests/security/xss-DENIED-mime-type-execute-as-html.html
​https://bugs.webkit.org/show_bug.cgi?id=45377

The test passes a MIME type as argument of a URL. A PHP code uses
that MIME type to fill the Content-Type of the response. If the
MIME type is application/rss+xml the php decodes the '+' as a
blank space and thus the returned content type is incorrectly set
to "rss xml" instead of "rss+xml".

• http/tests/security/resources/send-mime-types.php:
• http/tests/security/xss-DENIED-mime-type-execute-as-html.html:

Location:

trunk/LayoutTests

Files:

• ChangeLog (modified) (1 diff)
• http/tests/security/resources/send-mime-types.php (modified) (1 diff)
• http/tests/security/xss-DENIED-mime-type-execute-as-html.html (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-09-08  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        Errors in LayoutTests/http/tests/security/xss-DENIED-mime-type-execute-as-html.html
+        https://bugs.webkit.org/show_bug.cgi?id=45377
+
+        The test passes a MIME type as argument of a URL. A PHP code uses
+        that MIME type to fill the Content-Type of the response.  If the
+        MIME type is application/rss+xml the php decodes the '+' as a
+        blank space and thus the returned content type is incorrectly set
+        to "rss xml" instead of "rss+xml".
+
+        * http/tests/security/resources/send-mime-types.php:
+        * http/tests/security/xss-DENIED-mime-type-execute-as-html.html:
+
 2010-09-07  Martin Robinson  <mrobinson@igalia.com>
 

trunk/LayoutTests/http/tests/security/resources/send-mime-types.php

@@ -1 +1 @@
 <?php
-    $mime_type = urldecode($_GET["mt"]);
+    $mime_type = $_GET["mt"];
     
     header("Content-Type: ".$mime_type);

trunk/LayoutTests/http/tests/security/xss-DENIED-mime-type-execute-as-html.html

@@ -17 +17 @@
 for(var i in mime_types) {
   var ifr = document.createElement('iframe');
-  ifr.src = "http://localhost:8000/security/resources/send-mime-types.php?mt=" + escape(mime_types[i]);
+  ifr.src = "http://localhost:8000/security/resources/send-mime-types.php?mt=" + encodeURIComponent(mime_types[i]);
   document.body.appendChild(ifr);
 }