<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>53336</bug_id>
          
          <creation_ts>2011-01-28 15:15:03 -0800</creation_ts>
          <short_desc>Teach the XSSFilter about object and embed tags</short_desc>
          <delta_ts>2011-01-28 16:54:18 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Other</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>49845</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="Adam Barth">abarth</reporter>
          <assigned_to name="Adam Barth">abarth</assigned_to>
          <cc>dbates</cc>
    
    <cc>eric</cc>
    
    <cc>sam</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>341779</commentid>
    <comment_count>0</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2011-01-28 15:15:03 -0800</bug_when>
    <thetext>Teach the XSSFilter about object and embed tags</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>341788</commentid>
    <comment_count>1</comment_count>
      <attachid>80507</attachid>
    <who name="Adam Barth">abarth</who>
    <bug_when>2011-01-28 15:21:37 -0800</bug_when>
    <thetext>Created attachment 80507
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>341823</commentid>
    <comment_count>2</comment_count>
      <attachid>80507</attachid>
    <who name="Daniel Bates">dbates</who>
    <bug_when>2011-01-28 16:03:01 -0800</bug_when>
    <thetext>Comment on attachment 80507
Patch

LGTM.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>341863</commentid>
    <comment_count>3</comment_count>
      <attachid>80507</attachid>
    <who name="Adam Barth">abarth</who>
    <bug_when>2011-01-28 16:54:15 -0800</bug_when>
    <thetext>Comment on attachment 80507
Patch

Clearing flags on attachment: 80507

Committed r77031: &lt;http://trac.webkit.org/changeset/77031&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>341864</commentid>
    <comment_count>4</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2011-01-28 16:54:18 -0800</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>80507</attachid>
            <date>2011-01-28 15:21:37 -0800</date>
            <delta_ts>2011-01-28 16:54:15 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-53336-20110128152136.patch</filename>
            <type>text/plain</type>
            <size>4750</size>
            <attacher name="Adam Barth">abarth</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No
YW5nZUxvZwppbmRleCBhMWI5NGFlNWQxMTAyZDE4YjdlODM2ODI2ZWRhOTEzMDZjY2EzMWZiLi4z
Nzg0OTVhNzIwZmQ3MDcxNjQzNjM0MDk2YjNjZDczNjNjODc4YjEwIDEwMDY0NAotLS0gYS9Tb3Vy
Y2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0x
LDMgKzEsMjQgQEAKKzIwMTEtMDEtMjggIEFkYW0gQmFydGggIDxhYmFydGhAd2Via2l0Lm9yZz4K
KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZWFjaCB0
aGUgWFNTRmlsdGVyIGFib3V0IG9iamVjdCBhbmQgZW1iZWQgdGFncworICAgICAgICBodHRwczov
L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NTMzMzYKKworICAgICAgICBGb3IgPG9i
amVjdD4gYW5kIDxlbWJlZD4sIHdlIGZpbHRlciBvdXQgYXR0cmlidXRlIHZhbHVlcyB0aGF0IGVp
dGhlcgorICAgICAgICBpbmRpY2F0ZSB3aGljaCBwaWVjZSBvZiBtZWRpYSB0byBsb2FkIG9yIHdo
aWNoIHBsdWdpbiB0byBsb2FkLiAgSW4gYQorICAgICAgICBwZXJmZWN0IHdvcmxkLCB3ZSdkIG9u
bHkgbmVlZCB0byBmaWx0ZXIgb3V0IHRoZSBVUkxzIG9mIHRoZSBtZWRpYSwgYnV0CisgICAgICAg
IHNvbWUgcGx1Zy1pbnMgKGxpa2UgRmxhc2gpIGhhdmUgbG90cyBvZiBmdW4gcGxhY2VzIHlvdSBj
YW4gaGlkZSB0aGUKKyAgICAgICAgVVJMIChlLmcuLCB0aGUgIm1vdmllIiA8cGFyYW0+KS4KKwor
ICAgICAgICAqIGh0bWwvcGFyc2VyL1hTU0ZpbHRlci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpY
U1NGaWx0ZXI6OmZpbHRlclRva2VuKToKKyAgICAgICAgKFdlYkNvcmU6OlhTU0ZpbHRlcjo6Zmls
dGVyU2NyaXB0VG9rZW4pOgorICAgICAgICAoV2ViQ29yZTo6WFNTRmlsdGVyOjpmaWx0ZXJPYmpl
Y3RUb2tlbik6CisgICAgICAgIChXZWJDb3JlOjpYU1NGaWx0ZXI6OmZpbHRlckVtYmVkVG9rZW4p
OgorICAgICAgICAoV2ViQ29yZTo6WFNTRmlsdGVyOjplcmFzZUF0dHJpYnV0ZUlmSW5qZWN0ZWQp
OgorICAgICAgICAqIGh0bWwvcGFyc2VyL1hTU0ZpbHRlci5oOgorCiAyMDExLTAxLTI4ICBKdXN0
aW4gU2NodWggIDxqc2NodWhAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEVy
aWMgU2VpZGVsLgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvWFNTRmls
dGVyLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5jcHAKaW5kZXgg
OTJlYTM4YTY4MmQ5OGQyMGMwNGNmYzZlOWI4NWJiMGQ0MzljZjQ3Mi4uNTU0NTU0YTNkODIwOGVk
Y2QxOTRmNWU0MjY0MGE0OTJkMmM0M2NjOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaHRt
bC9wYXJzZXIvWFNTRmlsdGVyLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9Y
U1NGaWx0ZXIuY3BwCkBAIC0xMDcsMTAgKzEwNywxNCBAQCB2b2lkIFhTU0ZpbHRlcjo6ZmlsdGVy
VG9rZW4oSFRNTFRva2VuJiB0b2tlbikKICAgICBpZiAodG9rZW4udHlwZSgpICE9IEhUTUxUb2tl
bjo6U3RhcnRUYWcpCiAgICAgICAgIHJldHVybjsKIAotICAgIGlmIChoYXNOYW1lKHRva2VuLCBz
Y3JpcHRUYWcpKSB7Ci0gICAgICAgIGZpbHRlclNjcmlwdFRva2VuKHRva2VuKTsKLSAgICAgICAg
cmV0dXJuOwotICAgIH0KKyAgICBpZiAoaGFzTmFtZSh0b2tlbiwgc2NyaXB0VGFnKSkKKyAgICAg
ICAgcmV0dXJuIGZpbHRlclNjcmlwdFRva2VuKHRva2VuKTsKKworICAgIGlmIChoYXNOYW1lKHRv
a2VuLCBvYmplY3RUYWcpKQorICAgICAgICByZXR1cm4gZmlsdGVyT2JqZWN0VG9rZW4odG9rZW4p
OworCisgICAgaWYgKGhhc05hbWUodG9rZW4sIGVtYmVkVGFnKSkKKyAgICAgICAgcmV0dXJuIGZp
bHRlckVtYmVkVG9rZW4odG9rZW4pOwogCiAgICAgZm9yIChzaXplX3QgaSA9IDA7IGkgPCB0b2tl
bi5hdHRyaWJ1dGVzKCkuc2l6ZSgpOyArK2kpIHsKICAgICAgICAgY29uc3QgSFRNTFRva2VuOjpB
dHRyaWJ1dGUmIGF0dHJpYnV0ZSA9IHRva2VuLmF0dHJpYnV0ZXMoKS5hdChpKTsKQEAgLTE0OSwx
OCArMTUzLDQ2IEBAIHZvaWQgWFNTRmlsdGVyOjpmaWx0ZXJTY3JpcHRUb2tlbihIVE1MVG9rZW4m
IHRva2VuKQogICAgIEFTU0VSVCh0b2tlbi50eXBlKCkgPT0gSFRNTFRva2VuOjpTdGFydFRhZyk7
CiAgICAgQVNTRVJUKGhhc05hbWUodG9rZW4sIHNjcmlwdFRhZykpOwogCi0gICAgc2l6ZV90IGlu
ZGV4T2ZGaXJzdFNyY0F0dHJpYnV0ZTsKLSAgICBpZiAoZmluZEF0dHJpYnV0ZVdpdGhOYW1lKHRv
a2VuLCBzcmNBdHRyLCBpbmRleE9mRmlyc3RTcmNBdHRyaWJ1dGUpKSB7Ci0gICAgICAgIGNvbnN0
IEhUTUxUb2tlbjo6QXR0cmlidXRlJiBzcmNBdHRyaWJ1dGUgPSB0b2tlbi5hdHRyaWJ1dGVzKCku
YXQoaW5kZXhPZkZpcnN0U3JjQXR0cmlidXRlKTsKLSAgICAgICAgaWYgKGlzQ29udGFpbmVkSW5S
ZXF1ZXN0KHNuaXBwZXRGb3JBdHRyaWJ1dGUodG9rZW4sIHNyY0F0dHJpYnV0ZSkpKQotICAgICAg
ICAgICAgdG9rZW4uZXJhc2VWYWx1ZU9mQXR0cmlidXRlKGluZGV4T2ZGaXJzdFNyY0F0dHJpYnV0
ZSk7CisgICAgaWYgKGVyYXNlQXR0cmlidXRlSWZJbmplY3RlZCh0b2tlbiwgc3JjQXR0cikpCiAg
ICAgICAgIHJldHVybjsKLSAgICB9CiAKICAgICBtX3N0YXRlID0gQWZ0ZXJTY3JpcHRTdGFydFRh
ZzsKICAgICBtX2NhY2hlZFNuaXBwZXQgPSBtX3BhcnNlci0+c291cmNlRm9yVG9rZW4odG9rZW4p
OwogfQogCit2b2lkIFhTU0ZpbHRlcjo6ZmlsdGVyT2JqZWN0VG9rZW4oSFRNTFRva2VuJiB0b2tl
bikKK3sKKyAgICBBU1NFUlQobV9zdGF0ZSA9PSBJbml0aWFsKTsKKyAgICBBU1NFUlQodG9rZW4u
dHlwZSgpID09IEhUTUxUb2tlbjo6U3RhcnRUYWcpOworICAgIEFTU0VSVChoYXNOYW1lKHRva2Vu
LCBvYmplY3RUYWcpKTsKKworICAgIGVyYXNlQXR0cmlidXRlSWZJbmplY3RlZCh0b2tlbiwgZGF0
YUF0dHIpOworICAgIGVyYXNlQXR0cmlidXRlSWZJbmplY3RlZCh0b2tlbiwgdHlwZUF0dHIpOwor
ICAgIGVyYXNlQXR0cmlidXRlSWZJbmplY3RlZCh0b2tlbiwgY2xhc3NpZEF0dHIpOworfQorCit2
b2lkIFhTU0ZpbHRlcjo6ZmlsdGVyRW1iZWRUb2tlbihIVE1MVG9rZW4mIHRva2VuKQoreworICAg
IEFTU0VSVChtX3N0YXRlID09IEluaXRpYWwpOworICAgIEFTU0VSVCh0b2tlbi50eXBlKCkgPT0g
SFRNTFRva2VuOjpTdGFydFRhZyk7CisgICAgQVNTRVJUKGhhc05hbWUodG9rZW4sIGVtYmVkVGFn
KSk7CisKKyAgICBlcmFzZUF0dHJpYnV0ZUlmSW5qZWN0ZWQodG9rZW4sIHNyY0F0dHIpOworICAg
IGVyYXNlQXR0cmlidXRlSWZJbmplY3RlZCh0b2tlbiwgdHlwZUF0dHIpOworfQorCitib29sIFhT
U0ZpbHRlcjo6ZXJhc2VBdHRyaWJ1dGVJZkluamVjdGVkKEhUTUxUb2tlbiYgdG9rZW4sIGNvbnN0
IFF1YWxpZmllZE5hbWUmIGF0dHJpYnV0ZU5hbWUpCit7CisgICAgc2l6ZV90IGluZGV4T2ZBdHRy
aWJ1dGU7CisgICAgaWYgKGZpbmRBdHRyaWJ1dGVXaXRoTmFtZSh0b2tlbiwgYXR0cmlidXRlTmFt
ZSwgaW5kZXhPZkF0dHJpYnV0ZSkpIHsKKyAgICAgICAgY29uc3QgSFRNTFRva2VuOjpBdHRyaWJ1
dGUmIGF0dHJpYnV0ZSA9IHRva2VuLmF0dHJpYnV0ZXMoKS5hdChpbmRleE9mQXR0cmlidXRlKTsK
KyAgICAgICAgaWYgKGlzQ29udGFpbmVkSW5SZXF1ZXN0KHNuaXBwZXRGb3JBdHRyaWJ1dGUodG9r
ZW4sIGF0dHJpYnV0ZSkpKQorICAgICAgICAgICAgdG9rZW4uZXJhc2VWYWx1ZU9mQXR0cmlidXRl
KGluZGV4T2ZBdHRyaWJ1dGUpOworICAgICAgICByZXR1cm4gdHJ1ZTsKKyAgICB9CisgICAgcmV0
dXJuIGZhbHNlOworfQorCiBTdHJpbmcgWFNTRmlsdGVyOjpzbmlwcGV0Rm9yUmFuZ2UoY29uc3Qg
SFRNTFRva2VuJiB0b2tlbiwgaW50IHN0YXJ0LCBpbnQgZW5kKQogewogICAgIC8vIEZJWE1FOiBU
aGVyZSdzIGFuIGV4dHJhIGFsbG9jYXRpb24gaGVyZSB0aGF0IHdlIGNvdWxkIHNhdmUgYnkKZGlm
ZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL1hTU0ZpbHRlci5oIGIvU291cmNl
L1dlYkNvcmUvaHRtbC9wYXJzZXIvWFNTRmlsdGVyLmgKaW5kZXggODlhYzk1YTg0M2EzMTdkNWIy
NjRlMDY3NzFhNjA3MzhhMTFkMmVkMS4uMjRlOTY3NDg5ZDVjNjAyZmU3MGQ1Yzg3OTVkYmI2ZDQy
OWM5MGUxMCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvWFNTRmlsdGVy
LmgKKysrIGIvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvWFNTRmlsdGVyLmgKQEAgLTQ3LDYg
KzQ3LDEwIEBAIHByaXZhdGU6CiAKICAgICB2b2lkIGZpbHRlclRva2VuQWZ0ZXJTY3JpcHRTdGFy
dFRhZyhIVE1MVG9rZW4mKTsKICAgICB2b2lkIGZpbHRlclNjcmlwdFRva2VuKEhUTUxUb2tlbiYp
OworICAgIHZvaWQgZmlsdGVyT2JqZWN0VG9rZW4oSFRNTFRva2VuJik7CisgICAgdm9pZCBmaWx0
ZXJFbWJlZFRva2VuKEhUTUxUb2tlbiYpOworCisgICAgYm9vbCBlcmFzZUF0dHJpYnV0ZUlmSW5q
ZWN0ZWQoSFRNTFRva2VuJiwgY29uc3QgUXVhbGlmaWVkTmFtZSYpOwogCiAgICAgU3RyaW5nIHNu
aXBwZXRGb3JSYW5nZShjb25zdCBIVE1MVG9rZW4mLCBpbnQgc3RhcnQsIGludCBlbmQpOwogICAg
IFN0cmluZyBzbmlwcGV0Rm9yQXR0cmlidXRlKGNvbnN0IEhUTUxUb2tlbiYsIGNvbnN0IEhUTUxU
b2tlbjo6QXR0cmlidXRlJik7Cg==
</data>

          </attachment>
      

    </bug>

</bugzilla>