Changeset 77588 in webkit


Ignore:
Timestamp:
Feb 3, 2011 7:56:40 PM (13 years ago)
Author:
abarth@webkit.org
Message:

2011-02-03 Adam Barth <​abarth@webkit.org>

Reviewed by Daniel Bates.

XSS Auditor severely affects loading performance after submitting a large form
​https://bugs.webkit.org/show_bug.cgi?id=49845

The XSSFilter catches some more cases and has different console
messages than the XSSAuditor. We might want to improve these messages
in the future.

  • http/tests/security/xssAuditor/base-href-control-char-expected.txt:
  • http/tests/security/xssAuditor/base-href-expected.txt:
  • http/tests/security/xssAuditor/base-href-null-char-expected.txt:
  • http/tests/security/xssAuditor/base-href-scheme-relative-expected.txt:
  • http/tests/security/xssAuditor/dom-write-innerHTML-expected.txt:
  • http/tests/security/xssAuditor/embed-tag-control-char-expected.txt:
  • http/tests/security/xssAuditor/embed-tag-expected.txt:
  • http/tests/security/xssAuditor/embed-tag-javascript-url-expected.txt:
  • http/tests/security/xssAuditor/embed-tag-null-char-expected.txt:
  • http/tests/security/xssAuditor/full-block-base-href-expected.txt:
  • http/tests/security/xssAuditor/full-block-object-tag-expected.txt:
  • http/tests/security/xssAuditor/link-onclick-entities-expected.txt:
  • http/tests/security/xssAuditor/object-embed-tag-control-char-expected.txt:
  • http/tests/security/xssAuditor/object-embed-tag-expected.txt:
  • http/tests/security/xssAuditor/object-embed-tag-null-char-expected.txt:
  • http/tests/security/xssAuditor/object-tag-expected.txt:
  • http/tests/security/xssAuditor/object-tag-javascript-url-expected.txt:
  • http/tests/security/xssAuditor/script-tag-with-source-entities-expected.txt:

2011-02-03 Adam Barth <​abarth@webkit.org>

Reviewed by Daniel Bates.

XSS Auditor severely affects loading performance after submitting a large form
​https://bugs.webkit.org/show_bug.cgi?id=49845

Switch over from the XSSAuditor to the XSSFilter, improving performance
on this example.

  • html/parser/XSSFilter.cpp: (WebCore::XSSFilter::filterToken):
  • page/XSSAuditor.cpp: (WebCore::XSSAuditor::isEnabled):
Location:
trunk
Files:
22 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r77583 r77588  
     12011-02-03  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Daniel Bates.
     4
     5        XSS Auditor severely affects loading performance after submitting a large form
     6        https://bugs.webkit.org/show_bug.cgi?id=49845
     7
     8        The XSSFilter catches some more cases and has different console
     9        messages than the XSSAuditor.  We might want to improve these messages
     10        in the future.
     11
     12        * http/tests/security/xssAuditor/base-href-control-char-expected.txt:
     13        * http/tests/security/xssAuditor/base-href-expected.txt:
     14        * http/tests/security/xssAuditor/base-href-null-char-expected.txt:
     15        * http/tests/security/xssAuditor/base-href-scheme-relative-expected.txt:
     16        * http/tests/security/xssAuditor/dom-write-innerHTML-expected.txt:
     17        * http/tests/security/xssAuditor/embed-tag-control-char-expected.txt:
     18        * http/tests/security/xssAuditor/embed-tag-expected.txt:
     19        * http/tests/security/xssAuditor/embed-tag-javascript-url-expected.txt:
     20        * http/tests/security/xssAuditor/embed-tag-null-char-expected.txt:
     21        * http/tests/security/xssAuditor/full-block-base-href-expected.txt:
     22        * http/tests/security/xssAuditor/full-block-object-tag-expected.txt:
     23        * http/tests/security/xssAuditor/link-onclick-entities-expected.txt:
     24        * http/tests/security/xssAuditor/object-embed-tag-control-char-expected.txt:
     25        * http/tests/security/xssAuditor/object-embed-tag-expected.txt:
     26        * http/tests/security/xssAuditor/object-embed-tag-null-char-expected.txt:
     27        * http/tests/security/xssAuditor/object-tag-expected.txt:
     28        * http/tests/security/xssAuditor/object-tag-javascript-url-expected.txt:
     29        * http/tests/security/xssAuditor/script-tag-with-source-entities-expected.txt:
     30
    1312011-02-03  Maciej Stachowiak  <mjs@apple.com>
    232

  • trunk/LayoutTests/http/tests/security/xssAuditor/base-href-control-char-expected.txt

    r51445 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load from document base URL. URL found within request.
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    33ALERT: This is a safe script.

  • trunk/LayoutTests/http/tests/security/xssAuditor/base-href-expected.txt

    r51445 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load from document base URL. URL found within request.
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    33ALERT: This is a safe script.

  • trunk/LayoutTests/http/tests/security/xssAuditor/base-href-null-char-expected.txt

    r51445 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load from document base URL. URL found within request.
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    33ALERT: This is a safe script.

  • trunk/LayoutTests/http/tests/security/xssAuditor/base-href-scheme-relative-expected.txt

    r51445 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load from document base URL. URL found within request.
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    33ALERT: This is a safe script.

  • trunk/LayoutTests/http/tests/security/xssAuditor/dom-write-innerHTML-expected.txt

    r65987 r77588  
    1 ALERT: /XSS/
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
     3

  • trunk/LayoutTests/http/tests/security/xssAuditor/embed-tag-control-char-expected.txt

    r68854 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://127.0.0.1:8000/security/xssAuditor/resources/dummy.swf".
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    33

  • trunk/LayoutTests/http/tests/security/xssAuditor/embed-tag-expected.txt

    r51445 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://127.0.0.1:8000/security/xssAuditor/resources/dummy.swf".
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    33

  • trunk/LayoutTests/http/tests/security/xssAuditor/embed-tag-javascript-url-expected.txt

    r51445 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "javascript:alert(document.domain)".
    2 
    3 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "javascript:alert(document.domain)".
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    42
    53

  • trunk/LayoutTests/http/tests/security/xssAuditor/embed-tag-null-char-expected.txt

    r69798 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://127.0.0.1:8000/sec�urity/xssAuditor/resources/dummy.swf".
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    33

  • trunk/LayoutTests/http/tests/security/xssAuditor/full-block-base-href-expected.txt

    r54202 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load from document base URL. URL found within request.
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    33There should be no content in the iframe below:

  • trunk/LayoutTests/http/tests/security/xssAuditor/full-block-object-tag-expected.txt

    r54202 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://localhost:8000/security/xssAuditor/resources/dummy.swf".
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    33There should be no content in the iframe below:

  • trunk/LayoutTests/http/tests/security/xssAuditor/link-onclick-entities-expected.txt

    r65355 r77588  
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    12
     3

  • trunk/LayoutTests/http/tests/security/xssAuditor/object-embed-tag-control-char-expected.txt

    r68854 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://127.0.0.1:8000/security/xssAuditor/resources/dummy.swf".
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    3 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://127.0.0.1:8000/security/xssAuditor/resources/dummy.swf".
     3CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
     4
     5CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    46
    57

  • trunk/LayoutTests/http/tests/security/xssAuditor/object-embed-tag-expected.txt

    r66254 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://127.0.0.1:8000/security/xssAuditor/resources/dummy.swf".
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    3 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://127.0.0.1:8000/security/xssAuditor/resources/dummy.swf".
     3CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
     4
     5CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    46
    57

  • trunk/LayoutTests/http/tests/security/xssAuditor/object-embed-tag-null-char-expected.txt

    r69798 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://127.0.0.1:8000/sec�urity/xssAuditor/resources/dummy.swf".
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
    3 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://127.0.0.1:8000/sec�urity/xssAuditor/resources/dummy.swf".
     3CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
     4
     5CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    46
    57

  • trunk/LayoutTests/http/tests/security/xssAuditor/object-tag-expected.txt

    r51445 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "http://127.0.0.1:8000/security/xssAuditor/resources/dummy.swf".
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
     2
     3CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    24
    35

  • trunk/LayoutTests/http/tests/security/xssAuditor/object-tag-javascript-url-expected.txt

    r51445 r77588  
    1 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "javascript:alert(document.domain)".
    2 
    3 CONSOLE MESSAGE: line 1: Refused to load an object. URL found within request: "javascript:alert(document.domain)".
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    42
    53

  • trunk/LayoutTests/http/tests/security/xssAuditor/script-tag-with-source-entities-expected.txt

    r65355 r77588  
    1 ALERT: /XSS/
     1CONSOLE MESSAGE: line 1: Refused to execute a JavaScript script. Source code of script found within request.
    22
     3

  • trunk/Source/WebCore/ChangeLog

    r77587 r77588  
     12011-02-03  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Daniel Bates.
     4
     5        XSS Auditor severely affects loading performance after submitting a large form
     6        https://bugs.webkit.org/show_bug.cgi?id=49845
     7
     8        Switch over from the XSSAuditor to the XSSFilter, improving performance
     9        on this example.
     10
     11        * html/parser/XSSFilter.cpp:
     12        (WebCore::XSSFilter::filterToken):
     13        * page/XSSAuditor.cpp:
     14        (WebCore::XSSAuditor::isEnabled):
     15
    1162011-02-03  Dirk Pranke  <dpranke@chromium.org>
    217

  • trunk/Source/WebCore/html/parser/XSSFilter.cpp

    r77560 r77588  
    3939#include <wtf/text/CString.h>
    4040
    41 // This preprocesssor macro is a temporary scaffold while this code is still an experiment.
    42 #define XSS_DETECTOR_ENABLED 0
    43 
    4441namespace WebCore {
    4542
    … …  
    189186void XSSFilter::filterToken(HTMLToken& token)
    190187{
    191 #if !XSS_DETECTOR_ENABLED
    192     ASSERT_UNUSED(token, &token);
    193     return;
    194 #else
    195188    if (m_state == Uninitialized) {
    196189        init();
    … …  
    228221        }
    229222    }
    230 #endif
    231223}
    232224

  • trunk/Source/WebCore/page/XSSAuditor.cpp

    r73444 r77588  
    114114bool XSSAuditor::isEnabled() const
    115115{
    116     Settings* settings = m_frame->settings();
    117     return (settings && settings->xssAuditorEnabled());
     116    // FIXME: Remove this class if the transition to XSSFilter goes smoothly.
     117    return false;
    118118}
    119119
Note: See TracChangeset for help on using the changeset viewer.