Changeset 77033 in webkit

Timestamp:

Jan 28, 2011 4:57:05 PM (13 years ago)

Author:

abarth@webkit.org

Message:

2011-01-28 Adam Barth <​abarth@webkit.org>

Reviewed by Daniel Bates.

Teach XSSFilter about <meta> and <base> tags
​https://bugs.webkit.org/show_bug.cgi?id=53339

I'm not 100% sure we need to block <meta http-equiv>, but it seems
prudent given how powerful that attribute is. We definitely need to
block injection of <base href> because that can redirect script tags
that use relative URLs.

• html/parser/XSSFilter.cpp: (WebCore::XSSFilter::filterToken): (WebCore::XSSFilter::filterMetaToken): (WebCore::XSSFilter::filterBaseToken):
• html/parser/XSSFilter.h:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/parser/XSSFilter.cpp (modified) (2 diffs)
• html/parser/XSSFilter.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Daniel Bates.
+
+        Teach XSSFilter about <meta> and <base> tags
+        https://bugs.webkit.org/show_bug.cgi?id=53339
+
+        I'm not 100% sure we need to block <meta http-equiv>, but it seems
+        prudent given how powerful that attribute is.  We definitely need to
+        block injection of <base href> because that can redirect script tags
+        that use relative URLs.
+
+        * html/parser/XSSFilter.cpp:
+        (WebCore::XSSFilter::filterToken):
+        (WebCore::XSSFilter::filterMetaToken):
+        (WebCore::XSSFilter::filterBaseToken):
+        * html/parser/XSSFilter.h:
+
 2011-01-28  Adam Barth  <abarth@webkit.org>
 

trunk/Source/WebCore/html/parser/XSSFilter.cpp

@@ -120 +120 @@
         return filterAppletToken(token);
 
+    if (hasName(token, metaTag))
+        return filterMetaToken(token);
+
+    if (hasName(token, baseTag))
+        return filterBaseToken(token);
+
     for (size_t i = 0; i < token.attributes().size(); ++i) {
         const HTMLToken::Attribute& attribute = token.attributes().at(i);
@@ -195 +201 @@
 }
 
+void XSSFilter::filterMetaToken(HTMLToken& token)
+{
+    ASSERT(m_state == Initial);
+    ASSERT(token.type() == HTMLToken::StartTag);
+    ASSERT(hasName(token, metaTag));
+
+    eraseAttributeIfInjected(token, http_equivAttr);
+}
+
+void XSSFilter::filterBaseToken(HTMLToken& token)
+{
+    ASSERT(m_state == Initial);
+    ASSERT(token.type() == HTMLToken::StartTag);
+    ASSERT(hasName(token, baseTag));
+
+    eraseAttributeIfInjected(token, hrefAttr);
+}
+
 bool XSSFilter::eraseAttributeIfInjected(HTMLToken& token, const QualifiedName& attributeName)
 {

trunk/Source/WebCore/html/parser/XSSFilter.h

@@ -51 +51 @@
     void filterEmbedToken(HTMLToken&);
     void filterAppletToken(HTMLToken&);
+    void filterMetaToken(HTMLToken&);
+    void filterBaseToken(HTMLToken&);
 
     bool eraseAttributeIfInjected(HTMLToken&, const QualifiedName&);