blob: de030bbd974f6326e6ea93574c6a5b0efa5b9d9f [file] [log] [blame]
<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.setXSSAuditorEnabled(true);
}
</script>
</head>
<body>
<p>This test fails because the XSSAuditor allows requests that do not contain illegal URI characters. Thus,
the XSSAuditor does not detect breaking out of an unquoted property. A future update may reinstate this
functionality.</p>
<iframe src="http://localhost:8000/security/xssAuditor/resources/echo-property-noquotes.pl?q=dummy%09/onload=alert(String.fromCharCode(0x58,0x53,0x53))&dummy=dummy">
</iframe>
</body>
</html>