Properly escape user input for notifications, since URL-encoded characters ar...

chrome/browser/notifications/desktop_notification_service.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/notifications/desktop_notification_service.h"
 
 #include "app/l10n_util.h"
 #include "app/resource_bundle.h"
 #include "base/thread.h"
 #include "base/utf_string_conversions.h"
@@ skipping 25 matching lines @@
 #include "third_party/WebKit/WebKit/chromium/public/WebNotificationPresenter.h"
 
 using WebKit::WebNotificationPresenter;
 
 // static
 string16 DesktopNotificationService::CreateDataUrl(
     const GURL& icon_url, const string16& title, const string16& body) {
   int resource;
   string16 line_name;
   string16 line;
-  std::vector<string16> subst;
+  std::vector<std::string> subst;
   if (icon_url.is_valid()) {
     resource = IDR_NOTIFICATION_ICON_HTML;
-    subst.push_back(UTF8ToUTF16(icon_url.spec()));
-    subst.push_back(UTF8ToUTF16(EscapeForHTML(UTF16ToUTF8(title))));
-    subst.push_back(UTF8ToUTF16(EscapeForHTML(UTF16ToUTF8(body))));
+    subst.push_back(icon_url.spec());
+    subst.push_back(EscapeForHTML(UTF16ToUTF8(title)));
+    subst.push_back(EscapeForHTML(UTF16ToUTF8(body)));
   } else if (title.empty() || body.empty()) {
     resource = IDR_NOTIFICATION_1LINE_HTML;
     line = title.empty() ? body : title;
     // Strings are div names in the template file.
     line_name = title.empty() ? ASCIIToUTF16("description")
                               : ASCIIToUTF16("title");
-    subst.push_back(UTF8ToUTF16(EscapeForHTML(UTF16ToUTF8(line_name))));
-    subst.push_back(UTF8ToUTF16(EscapeForHTML(UTF16ToUTF8(line))));
+    subst.push_back(EscapeForHTML(UTF16ToUTF8(line_name)));
+    subst.push_back(EscapeForHTML(UTF16ToUTF8(line)));
   } else {
     resource = IDR_NOTIFICATION_2LINE_HTML;
-    subst.push_back(UTF8ToUTF16(EscapeForHTML(UTF16ToUTF8(title))));
-    subst.push_back(UTF8ToUTF16(EscapeForHTML(UTF16ToUTF8(body))));
+    subst.push_back(EscapeForHTML(UTF16ToUTF8(title)));
+    subst.push_back(EscapeForHTML(UTF16ToUTF8(body)));
   }
 
   const base::StringPiece template_html(
       ResourceBundle::GetSharedInstance().GetRawDataResource(
           resource));
 
   if (template_html.empty()) {
     NOTREACHED() << "unable to load template. ID: " << resource;
     return string16();
   }
 
-  string16 format_string = ASCIIToUTF16("data:text/html;charset=utf-8,"
-                                        + template_html.as_string());
-  return ReplaceStringPlaceholders(format_string, subst, NULL);
+  std::string data = ReplaceStringPlaceholders(template_html, subst, NULL);
+  return UTF8ToUTF16("data:text/html;charset=utf-8," +
+                      EscapeQueryParamValue(data, false));
 }
 
 // A task object which calls the renderer to inform the web page that the
 // permission request has completed.
 class NotificationPermissionCallbackTask : public Task {
  public:
   NotificationPermissionCallbackTask(int process_id, int route_id,
       int request_id)
       : process_id_(process_id),
         route_id_(route_id),
@@ skipping 353 matching lines @@
   if (origin.SchemeIs(chrome::kExtensionScheme)) {
     ExtensionsService* ext_service = profile_->GetExtensionsService();
     if (ext_service) {
       Extension* extension = ext_service->GetExtensionByURL(origin);
       if (extension)
         return UTF8ToWide(extension->name());
     }
   }
   return UTF8ToWide(origin.host());
 }