Properly escape user input for notifications, since URL-encoded characters ar...

chrome/browser/notifications/desktop_notifications_unittest.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/notifications/desktop_notifications_unittest.h"
 
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 
 // static
@@ skipping 263 matching lines @@
   service_.reset(NULL);
 }
 
 TEST_F(DesktopNotificationsTest, TestUserInputEscaping) {
   // Create a test script with some HTML; assert that it doesn't get into the
   // data:// URL that's produced for the balloon.
   EXPECT_TRUE(service_->ShowDesktopNotificationText(
       GURL("http://www.google.com"),
       GURL("/icon.png"),
       ASCIIToUTF16("<script>window.alert('uh oh');</script>"),
-      ASCIIToUTF16("<i>this text is in italics</i>"),
+      ASCIIToUTF16("<i>this text is in italics</i>, as is %3ci%3ethis%3c/i%3e"),
       0, 0, DesktopNotificationService::PageNotification, 1));
 
   MessageLoopForUI::current()->RunAllPending();
   EXPECT_EQ(1, balloon_collection_->count());
   Balloon* balloon = (*balloon_collection_->balloons().begin());
   GURL data_url = balloon->notification().content_url();
   EXPECT_EQ(std::string::npos, data_url.spec().find("<script>"));
   EXPECT_EQ(std::string::npos, data_url.spec().find("<i>"));
+  // URL-encoded versions of tags should also not be found.
+  EXPECT_EQ(std::string::npos, data_url.spec().find("%3cscript%3e"));
+  EXPECT_EQ(std::string::npos, data_url.spec().find("%3ci%3e"));
 }