Profile/user menu on NTP should look more clickable?

chrome/browser/ui/webui/ntp/ntp_login_handler.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/ntp/ntp_login_handler.h"
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 18 matching lines @@
 #include "chrome/browser/ui/webui/web_ui_util.h"
 #include "chrome/browser/web_resource/promo_resource_service.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "content/browser/tab_contents/tab_contents.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_service.h"
 #include "grit/chromium_strings.h"
 #include "grit/generated_resources.h"
+#include "net/base/escape.h"
 #include "skia/ext/image_operations.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/gfx/canvas_skia.h"
 #include "ui/gfx/image/image.h"
 
 namespace {
 
 SkBitmap GetGAIAPictureForNTP(const gfx::Image& image) {
   // This value must match the width and height value of login-status-icon
   // in new_tab.css.
@@ skipping 128 matching lines @@
   std::string icon_url;
   if (!username.empty()) {
     ProfileInfoCache& cache =
         g_browser_process->profile_manager()->GetProfileInfoCache();
     size_t profile_index = cache.GetIndexOfProfileWithPath(profile->GetPath());
     if (profile_index != std::string::npos) {
       // Only show the profile picture and full name for the single profile
       // case. In the multi-profile case the profile picture is visible in the
       // title bar and the full name can be ambiguous.
       if (cache.GetNumberOfProfiles() == 1) {
-        header = cache.GetGAIANameOfProfileAtIndex(profile_index);
+        string16 name = cache.GetGAIANameOfProfileAtIndex(profile_index);
+        header = ASCIIToUTF16("<span class='profile-name'>") +
+                 net::EscapeForHTML(name) +

[sail, 2011/12/06 23:00:57]

Ahh, I didn't know about EscapeForHTML(). Can you do the same thing for
signed_in_link (below)

[Tyler Breisacher (Chromium), 2011/12/06 23:17:48]

I figured it's unlikely someone would say their name was, for example, "Sailesh
<script src="example.com/evil.js"><script> Agrawal" but better safe than sorry
:) Will do.

+                 ASCIIToUTF16("</span>");
         const gfx::Image* image =
             cache.GetGAIAPictureOfProfileAtIndex(profile_index);
         if (image)
           icon_url = web_ui_util::GetImageDataUrl(GetGAIAPictureForNTP(*image));
       }
       if (header.empty())
         header = UTF8ToUTF16(username);

[sail, 2011/12/06 23:00:57]

You'll need to modify this case as well

[sail, 2011/12/06 23:46:25]

Sorry, I mean you'll need to add "class='profile-name'" to this as well.

     }
   } else if (SyncPromoUI::ShouldShowSyncPromo(profile) &&
              (SyncPromoUI::UserHasSeenSyncPromoAtStartup(profile) ||
               PromoResourceService::CanShowNTPSignInPromo(profile))) {
     string16 signed_in_link = l10n_util::GetStringUTF16(
         IDS_SYNC_PROMO_NOT_SIGNED_IN_STATUS_LINK);
     signed_in_link = ASCIIToUTF16("<span class='link-span'>") + signed_in_link +
                      ASCIIToUTF16("</span>");
     header = l10n_util::GetStringFUTF16(
         IDS_SYNC_PROMO_NOT_SIGNED_IN_STATUS_HEADER,
@@ skipping 39 matching lines @@
           l10n_util::GetStringUTF16(IDS_SHORT_PRODUCT_NAME)));
   values->SetString("login_status_url",
       google_util::StringAppendGoogleLocaleParam(chrome::kSyncLearnMoreURL));
   values->SetString("login_status_learn_more",
       l10n_util::GetStringUTF16(IDS_LEARN_MORE));
   values->SetString("login_status_advanced",
       l10n_util::GetStringUTF16(IDS_SYNC_PROMO_NTP_BUBBLE_ADVANCED));
   values->SetString("login_status_dismiss",
       l10n_util::GetStringUTF16(IDS_SYNC_PROMO_NTP_BUBBLE_OK));
 }