File tree

• LayoutTests
  • ChangeLog
  • fast/frames
    • xss-auditor-handles-file-urls-expected.txt
    • xss-auditor-handles-file-urls.html
  • http/tests/security/xssAuditor
    • anchor-url-dom-write-location-expected.txt
    • anchor-url-dom-write-location-inline-event-expected.txt
    • anchor-url-dom-write-location-inline-event-null-char-expected.txt
    • anchor-url-dom-write-location-inline-event-null-char.html
    • anchor-url-dom-write-location-inline-event.html
    • anchor-url-dom-write-location-javascript-URL-expected.txt
    • anchor-url-dom-write-location-javascript-URL.html
    • anchor-url-dom-write-location.html
    • anchor-url-dom-write-location2-expected.txt
    • anchor-url-dom-write-location2.html
    • base-href-control-char-expected.txt
    • base-href-control-char.html
    • base-href-direct-expected.txt
    • base-href-direct.html
    • base-href-expected.txt
    • base-href-null-char-expected.txt
    • base-href-null-char.html
    • base-href-safe-expected.txt
    • base-href-safe.html
    • base-href-safe2-expected.txt
    • base-href-safe2.html
    • base-href-safe3-expected.txt
    • base-href-safe3.html
    • base-href-scheme-relative-expected.txt
    • base-href-scheme-relative.html
    • base-href.html
    • block-does-not-leak-location-expected.txt
    • block-does-not-leak-location.html
    • block-does-not-leak-referrer-expected.txt
    • block-does-not-leak-referrer.html
    • block-does-not-leak-that-page-was-blocked-using-empty-data-url-expected.txt
    • block-does-not-leak-that-page-was-blocked-using-empty-data-url.html
    • cached-frame-expected.txt
    • cached-frame.html
    • cookie-injection-expected.txt
    • cookie-injection.html
    • crash-while-loading-tag-with-pause-expected.txt
    • crash-while-loading-tag-with-pause.html
    • data-urls-work-expected.txt
    • data-urls-work.html
    • dom-write-URL-expected.txt
    • dom-write-URL.html
    • dom-write-innerHTML-expected.txt
    • dom-write-innerHTML.html
    • dom-write-location-dom-write-open-img-onerror-expected.txt
    • dom-write-location-dom-write-open-img-onerror.html
    • dom-write-location-expected.txt
    • dom-write-location-inline-event-expected.txt
    • dom-write-location-inline-event.html
    • dom-write-location-javascript-URL-expected.txt
    • dom-write-location-javascript-URL.html
    • dom-write-location-open-img-onerror-expected.txt
    • dom-write-location-open-img-onerror.html
    • dom-write-location.html
    • embed-tag-code-attribute-2-expected.txt
    • embed-tag-code-attribute-2.html
    • embed-tag-code-attribute-expected.txt
    • embed-tag-code-attribute.html
    • embed-tag-control-char-expected.txt
    • embed-tag-control-char.html
    • embed-tag-expected.txt
    • embed-tag-in-path-unterminated-expected.txt
    • embed-tag-in-path-unterminated.html
    • embed-tag-javascript-url-expected.txt
    • embed-tag-javascript-url.html
    • embed-tag-null-char-expected.txt
    • embed-tag-null-char.html
    • embed-tag.html
    • faux-script1-expected.txt
    • faux-script1.html
    • faux-script2-expected.txt
    • faux-script2.html
    • faux-script3-expected.txt
    • faux-script3.html
    • form-action-expected.txt
    • form-action.html
    • formaction-on-button-expected.txt
    • formaction-on-button.html
    • formaction-on-input-expected.txt
    • formaction-on-input.html
    • frameset-injection-expected.txt
    • frameset-injection.html
    • full-block-base-href-expected.txt
    • full-block-base-href.html
    • full-block-get-from-iframe-expected.txt
    • full-block-get-from-iframe.html
    • full-block-iframe-javascript-url-expected.txt
    • full-block-iframe-javascript-url.html
    • full-block-iframe-no-inherit-expected.txt
    • full-block-iframe-no-inherit.py
    • full-block-javascript-link-expected.txt
    • full-block-javascript-link.html
    • full-block-link-onclick-expected.txt
    • full-block-link-onclick.html
    • full-block-object-tag-expected.txt
    • full-block-object-tag.html
    • full-block-post-from-iframe-expected.txt
    • full-block-post-from-iframe.html
    • full-block-script-tag-cross-domain-expected.txt
    • full-block-script-tag-cross-domain.html
    • full-block-script-tag-expected.txt
    • full-block-script-tag-with-source-expected.txt
    • full-block-script-tag-with-source.html
    • full-block-script-tag.html
    • get-from-iframe-expected.txt
    • get-from-iframe.html
    • iframe-injection-allowed-2-expected.txt
    • iframe-injection-allowed-2.html
    • iframe-injection-allowed-3-expected.txt
    • iframe-injection-allowed-3.html
    • iframe-injection-allowed-expected.txt
    • iframe-injection-allowed.html
    • iframe-injection-expected.txt
    • iframe-injection.html
    • iframe-javascript-url-expected.txt
    • iframe-javascript-url-more-encoding-expected.txt
    • iframe-javascript-url-more-encoding.html
    • iframe-javascript-url-twice-url-encode-expected.txt
    • iframe-javascript-url-twice-url-encode.html
    • iframe-javascript-url-twice-url-encode2-expected.txt
    • iframe-javascript-url-twice-url-encode2.html
    • iframe-javascript-url-twice-url-encode3-expected.txt
    • iframe-javascript-url-twice-url-encode3.html
    • iframe-javascript-url-url-encoded-expected.txt
    • iframe-javascript-url-url-encoded.html
    • iframe-javascript-url.html
    • iframe-onload-GBK-char-expected.txt
    • iframe-onload-GBK-char.html
    • iframe-onload-in-svg-tag-expected.txt
    • iframe-onload-in-svg-tag.html
    • iframe-srcdoc-expected.txt
    • iframe-srcdoc-property-blocked-expected.txt
    • iframe-srcdoc-property-blocked.html
    • iframe-srcdoc.html
    • img-onerror-GBK-char-expected.txt
    • img-onerror-GBK-char.html
    • img-onerror-accented-char-expected.txt
    • img-onerror-accented-char.html
    • img-onerror-non-ASCII-char-default-encoding-expected.txt
    • img-onerror-non-ASCII-char-default-encoding.html
    • img-onerror-non-ASCII-char-expected.txt
    • img-onerror-non-ASCII-char.html
    • img-onerror-non-ASCII-char2-default-encoding-expected.txt
    • img-onerror-non-ASCII-char2-default-encoding.html
    • img-onerror-non-ASCII-char2-expected.txt
    • img-onerror-non-ASCII-char2.html
    • img-onerror-tricky-expected.txt
    • img-onerror-tricky.html
    • img-tag-with-comma-expected.txt
    • img-tag-with-comma.html
    • inline-event-HTML-entities-expected.txt
    • inline-event-HTML-entities.html
    • intercept
      • .htaccess
    • javascript-link-HTML-entities-control-char-expected.txt
    • javascript-link-HTML-entities-control-char.html
    • javascript-link-HTML-entities-expected.txt
    • javascript-link-HTML-entities-named-expected.txt
    • javascript-link-HTML-entities-named.html
    • javascript-link-HTML-entities-null-char-expected.txt
    • javascript-link-HTML-entities-null-char.html
    • javascript-link-HTML-entities.html
    • javascript-link-ampersand-expected.txt
    • javascript-link-ampersand.html
    • javascript-link-control-char-expected.txt
    • javascript-link-control-char.html
    • javascript-link-control-char2-expected.txt
    • javascript-link-control-char2.html
    • javascript-link-expected.txt
    • javascript-link-null-char-expected.txt
    • javascript-link-null-char.html
    • javascript-link-one-plus-one-expected.txt
    • javascript-link-one-plus-one.html
    • javascript-link-safe-expected.txt
    • javascript-link-safe.html
    • javascript-link-url-encoded-expected.txt
    • javascript-link-url-encoded.html
    • javascript-link.html
    • link-onclick-ampersand-expected.txt
    • link-onclick-ampersand.html
    • link-onclick-control-char-expected.txt
    • link-onclick-control-char.html
    • link-onclick-entities-expected.txt
    • link-onclick-entities.html
    • link-onclick-expected.txt
    • link-onclick-null-char-expected.txt
    • link-onclick-null-char.html
    • link-onclick.html
    • link-opens-new-window-expected.txt
    • link-opens-new-window.html
    • malformed-HTML-expected.txt
    • malformed-HTML.html
    • malformed-xss-protection-header-1-expected.txt
    • malformed-xss-protection-header-1.html
    • malformed-xss-protection-header-2-expected.txt
    • malformed-xss-protection-header-2.html
    • malformed-xss-protection-header-3-expected.txt
    • malformed-xss-protection-header-3.html
    • malformed-xss-protection-header-4-expected.txt
    • malformed-xss-protection-header-4.html
    • malformed-xss-protection-header-5-expected.txt
    • malformed-xss-protection-header-5.html
    • malformed-xss-protection-header-6-expected.txt
    • malformed-xss-protection-header-6.html
    • malformed-xss-protection-header-7-expected.txt
    • malformed-xss-protection-header-7.html
    • malformed-xss-protection-header-8-expected.txt
    • malformed-xss-protection-header-8.html
    • malformed-xss-protection-header-9-expected.txt
    • malformed-xss-protection-header-9.html
    • meta-tag-http-refresh-javascript-url-expected.txt
    • meta-tag-http-refresh-javascript-url.html
    • meta-tag-http-refresh-x-frame-options-ignored-expected.txt
    • meta-tag-http-refresh-x-frame-options-ignored.html
    • nested-dom-write-location-open-img-onerror-expected.txt
    • nested-dom-write-location-open-img-onerror.html
    • no-protection-script-tag-expected.txt
    • no-protection-script-tag.html
    • non-block-javascript-url-frame-expected.txt
    • non-block-javascript-url-frame.html
    • object-embed-tag-control-char-expected.txt
    • object-embed-tag-control-char.html
    • object-embed-tag-expected.txt
    • object-embed-tag-null-char-expected.txt
    • object-embed-tag-null-char.html
    • object-embed-tag.html
    • object-src-inject-expected.txt
    • object-src-inject.html
    • object-tag-expected.txt
    • object-tag-javascript-url-expected.txt
    • object-tag-javascript-url.html
    • object-tag.html
    • open-attribute-body-expected.txt
    • open-attribute-body.html
    • open-event-handler-iframe-expected.txt
    • open-event-handler-iframe.html
    • open-iframe-src-01-expected.txt
    • open-iframe-src-01.html
    • open-iframe-src-02-expected.txt
    • open-iframe-src-02.html
    • open-iframe-src-03-expected.txt
    • open-iframe-src-03.html
    • open-script-src-01-expected.txt
    • open-script-src-01.html
    • open-script-src-02-expected.txt
    • open-script-src-02.html
    • open-script-src-03-expected.txt
    • open-script-src-03.html
    • open-script-src-04-expected.txt
    • open-script-src-04.html
    • post-from-iframe-expected.txt
    • post-from-iframe.html
    • property-escape-comment-01-expected.txt
    • property-escape-comment-01.html
    • property-escape-comment-02-expected.txt
    • property-escape-comment-02.html
    • property-escape-comment-03-expected.txt
    • property-escape-comment-03.html
    • property-escape-entity-01-expected.txt
    • property-escape-entity-01.html
    • property-escape-entity-02-expected.txt
    • property-escape-entity-02.html
    • property-escape-entity-03-expected.txt
    • property-escape-entity-03.html
    • property-escape-expected.txt
    • property-escape-long-expected.txt
    • property-escape-long.html
    • property-escape-noquotes-expected.txt
    • property-escape-noquotes-tab-slash-chars-expected.txt
    • property-escape-noquotes-tab-slash-chars.html
    • property-escape-noquotes.html
    • property-escape-quote-01-expected.txt
    • property-escape-quote-01.html
    • property-escape-quote-02-expected.txt
    • property-escape-quote-02.html
    • property-escape-quote-03-expected.txt
    • property-escape-quote-03.html
    • property-escape.html
    • property-inject-expected.txt
    • property-inject.html
    • reflection-in-path-expected.txt
    • reflection-in-path.html
    • regress-167121-expected.txt
    • regress-167121.html
    • report-script-tag-and-do-not-follow-redirect-when-sending-report-expected.txt
    • report-script-tag-and-do-not-follow-redirect-when-sending-report.html
    • report-script-tag-expected.txt
    • report-script-tag-full-block-and-do-not-follow-redirect-when-sending-report-expected.txt
    • report-script-tag-full-block-and-do-not-follow-redirect-when-sending-report.html
    • report-script-tag-full-block-expected.txt
    • report-script-tag-full-block.html
    • report-script-tag-replace-state-expected.txt
    • report-script-tag-replace-state.html
    • report-script-tag.html
    • resources
      • anchor-url-dom-write-location-click.html
      • base-href
        • base-href-safe2.html
        • base-href-safe3.html
        • really-safe-script.js
        • safe-script.js
      • echo-dom-write-URL.html
      • echo-dom-write-innerHTML.html
      • echo-dom-write-location.html
      • echo-dom-write-unescaped-location.html
      • echo-form-action.pl
      • echo-frame-src.pl
      • echo-head-base-href-direct.pl
      • echo-head-base-href.pl
      • echo-head.pl
      • echo-inner-tag.pl
      • echo-inspan.pl
      • echo-intertag-addslashes.pl
      • echo-intertag-click-and-notify.pl
      • echo-intertag-decode-16bit-unicode.pl
      • echo-intertag-default-encode.pl
      • echo-intertag.pl
      • echo-nested-dom-write-location.html
      • echo-object-src.pl
      • echo-property-noquotes.pl
      • echo-property.pl
      • echo-script-src.pl
      • javascript-link-safe.html
      • nph-cached.pl
      • safe-script-noquotes.js
      • safe-script.js
      • script-tag-safe2.html
      • script-tag-safe3.html
      • script-tag-safe4-frame.html
      • tag-with-pause.py
      • utilities.js
      • xss-filter-bypass-long-string-reply.html
      • xss.js
    • script-tag-Big5-char-expected.txt
    • script-tag-Big5-char-twice-url-encode-16bit-unicode-expected.txt
    • script-tag-Big5-char-twice-url-encode-16bit-unicode.html
    • script-tag-Big5-char-twice-url-encode-expected.txt
    • script-tag-Big5-char-twice-url-encode.html
    • script-tag-Big5-char.html
    • script-tag-Big5-char2-expected.txt
    • script-tag-Big5-char2.html
    • script-tag-addslashes-backslash-expected.txt
    • script-tag-addslashes-backslash.html
    • script-tag-addslashes-double-quote-expected.txt
    • script-tag-addslashes-double-quote.html
    • script-tag-addslashes-null-char-expected.txt
    • script-tag-addslashes-null-char.html
    • script-tag-addslashes-single-quote-expected.txt
    • script-tag-addslashes-single-quote.html
    • script-tag-control-char-expected.txt
    • script-tag-control-char.html
    • script-tag-convoluted-expected.txt
    • script-tag-convoluted.html
    • script-tag-entities-expected.txt
    • script-tag-entities.html
    • script-tag-expected.txt
    • script-tag-expression-follows-expected.txt
    • script-tag-expression-follows.html
    • script-tag-inside-svg-tag-expected.txt
    • script-tag-inside-svg-tag.html
    • script-tag-inside-svg-tag2-expected.txt
    • script-tag-inside-svg-tag2.html
    • script-tag-inside-svg-tag3-expected.txt
    • script-tag-inside-svg-tag3.html
    • script-tag-near-start-expected.txt
    • script-tag-near-start.html
    • script-tag-null-char-expected.txt
    • script-tag-null-char.html
    • script-tag-open-redirect-expected.txt
    • script-tag-open-redirect.html
    • script-tag-post-control-char-expected.txt
    • script-tag-post-control-char.html
    • script-tag-post-expected.txt
    • script-tag-post-null-char-expected.txt
    • script-tag-post-null-char.html
    • script-tag-post.html
    • script-tag-redirect-expected.txt
    • script-tag-redirect.html
    • script-tag-safe-expected.txt
    • script-tag-safe.html
    • script-tag-safe2-expected.txt
    • script-tag-safe2.html
    • script-tag-safe3-expected.txt
    • script-tag-safe3.html
    • script-tag-safe4-expected.txt
    • script-tag-safe4.html
    • script-tag-src-redirect-safe-expected.txt
    • script-tag-src-redirect-safe.html
    • script-tag-with-16bit-unicode-expected.txt
    • script-tag-with-16bit-unicode-surrogate-pair-expected.txt
    • script-tag-with-16bit-unicode-surrogate-pair.html
    • script-tag-with-16bit-unicode.html
    • script-tag-with-16bit-unicode2-expected.txt
    • script-tag-with-16bit-unicode2.html
    • script-tag-with-16bit-unicode3-expected.txt
    • script-tag-with-16bit-unicode3.html
    • script-tag-with-16bit-unicode4-expected.txt
    • script-tag-with-16bit-unicode4.html
    • script-tag-with-16bit-unicode5-expected.txt
    • script-tag-with-16bit-unicode5.html
    • script-tag-with-actual-comma-expected.txt
    • script-tag-with-actual-comma.html
    • script-tag-with-callbacks-expected.txt
    • script-tag-with-callbacks.html
    • script-tag-with-comma-01-expected.txt
    • script-tag-with-comma-01.html
    • script-tag-with-comma-02-expected.txt
    • script-tag-with-comma-02.html
    • script-tag-with-fancy-unicode-expected.txt
    • script-tag-with-fancy-unicode.html
    • script-tag-with-injected-comment-expected.txt
    • script-tag-with-injected-comment.html
    • script-tag-with-invalid-closing-tag-expected.txt
    • script-tag-with-invalid-closing-tag.html
    • script-tag-with-invalid-url-encoding-expected.txt
    • script-tag-with-invalid-url-encoding.html
    • script-tag-with-source-control-char-expected.txt
    • script-tag-with-source-control-char.html
    • script-tag-with-source-data-url-expected.txt
    • script-tag-with-source-data-url.html
    • script-tag-with-source-data-url2-expected.txt
    • script-tag-with-source-data-url2.html
    • script-tag-with-source-data-url3-expected.txt
    • script-tag-with-source-data-url3.html
    • script-tag-with-source-data-url4-expected.txt
    • script-tag-with-source-data-url4.html
    • script-tag-with-source-data-url5-expected.txt
    • script-tag-with-source-data-url5.html
    • script-tag-with-source-double-quote-expected.txt
    • script-tag-with-source-double-quote.html
    • script-tag-with-source-entities-expected.txt
    • script-tag-with-source-entities.html
    • script-tag-with-source-expected.txt
    • script-tag-with-source-no-quote-expected.txt
    • script-tag-with-source-no-quote.html
    • script-tag-with-source-null-char-expected.txt
    • script-tag-with-source-null-char.html
    • script-tag-with-source-relative-scheme-expected.txt
    • script-tag-with-source-relative-scheme.html
    • script-tag-with-source-same-host-expected.txt
    • script-tag-with-source-same-host-with-query-expected.txt
    • script-tag-with-source-same-host-with-query.html
    • script-tag-with-source-same-host.html
    • script-tag-with-source-unterminated-01-expected.txt
    • script-tag-with-source-unterminated-01.html
    • script-tag-with-source-unterminated-02-expected.txt
    • script-tag-with-source-unterminated-02.html
    • script-tag-with-source-unterminated-03-expected.txt
    • script-tag-with-source-unterminated-03.html
    • script-tag-with-source.html
    • script-tag-with-three-times-url-encoded-16bit-unicode-expected.txt
    • script-tag-with-three-times-url-encoded-16bit-unicode.html
    • script-tag-with-trailing-comment-U2028-expected.txt
    • script-tag-with-trailing-comment-U2028.html
    • script-tag-with-trailing-comment-expected.txt
    • script-tag-with-trailing-comment.html
    • script-tag-with-trailing-comment2-expected.txt
    • script-tag-with-trailing-comment2.html
    • script-tag-with-trailing-comment3-expected.txt
    • script-tag-with-trailing-comment3.html
    • script-tag-with-trailing-comment4-expected.txt
    • script-tag-with-trailing-comment4.html
    • script-tag-with-trailing-comment5-expected.txt
    • script-tag-with-trailing-comment5.html
    • script-tag-with-trailing-script-and-urlencode-expected.txt
    • script-tag-with-trailing-script-and-urlencode.html
    • script-tag.html
    • svg-animate-expected.txt
    • svg-animate.html
    • svg-script-tag-expected.txt
    • svg-script-tag.html
    • window-open-without-url-should-not-assert-expected.txt
    • window-open-without-url-should-not-assert.html
    • xss-filter-bypass-big5-expected.txt
    • xss-filter-bypass-big5.html
    • xss-filter-bypass-long-string-expected.txt
    • xss-filter-bypass-long-string.html
    • xss-filter-bypass-sjis-expected.txt
    • xss-filter-bypass-sjis.html
    • xss-protection-parsing-01-expected.txt
    • xss-protection-parsing-01.html
    • xss-protection-parsing-02-expected.txt
    • xss-protection-parsing-02.html
    • xss-protection-parsing-03-expected.txt
    • xss-protection-parsing-03.html
    • xss-protection-parsing-04-expected.txt
    • xss-protection-parsing-04.html
  • platform
    • gtk
      • TestExpectations
    • ios-simulator-wk2
      • TestExpectations
    • ios-wk1
      • TestExpectations
    • win
      • TestExpectations
• Source/WebCore
  • ChangeLog
  • Sources.txt
  • WebCore.xcodeproj
    • project.pbxproj
  • html/parser
    • HTMLDocumentParser.cpp
    • HTMLDocumentParser.h
    • HTMLToken.h
    • XSSAuditor.cpp
    • XSSAuditor.h
    • XSSAuditorDelegate.cpp
    • XSSAuditorDelegate.h
  • loader
    • PingLoader.cpp
    • PingLoader.h