Escape '&' in javascript URLs for innerHTML/outerHTML

Source/core/editing/MarkupAccumulator.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 192 matching lines @@
 void MarkupAccumulator::appendAttributeValue(StringBuilder& result, const String& attribute, bool documentIsHTML)
 {
     appendCharactersReplacingEntities(result, attribute, 0, attribute.length(),
         documentIsHTML ? EntityMaskInHTMLAttributeValue : EntityMaskInAttributeValue);
 }
 
 void MarkupAccumulator::appendCustomAttributes(StringBuilder&, const Element&, Namespaces*)
 {
 }
 
-void MarkupAccumulator::appendQuotedURLAttributeValue(StringBuilder& result, const Element& element, const Attribute& attribute)
+void MarkupAccumulator::appendHTMLEscapedURLAttributeValue(StringBuilder& result, const Element& element, const Attribute& attribute)
 {
     ASSERT(element.isURLAttribute(attribute));
     const String resolvedURLString = resolveURLIfNeeded(element, attribute.value());
     UChar quoteChar = '"';
     String strippedURLString = resolvedURLString.stripWhiteSpace();
     if (protocolIsJavaScript(strippedURLString)) {
         // minimal escaping for javascript urls
+        if (strippedURLString.contains('&'))
+            strippedURLString.replaceWithLiteral('&', "&");
+
         if (strippedURLString.contains('"')) {
             if (strippedURLString.contains('\''))
                 strippedURLString.replaceWithLiteral('"', """);
             else
                 quoteChar = '\'';
         }
         result.append(quoteChar);
         result.append(strippedURLString);
         result.append(quoteChar);
         return;
@@ skipping 236 matching lines @@
                 appendNamespace(result, prefixedName.prefix(), attribute.namespaceURI(), *namespaces);
             }
         }
         result.append(' ');
         result.append(prefixedName.toString());
     }
 
     result.append('=');
 
     if (element.isURLAttribute(attribute)) {
-        appendQuotedURLAttributeValue(result, element, attribute);
+        appendHTMLEscapedURLAttributeValue(result, element, attribute);
     } else {
         result.append('"');
         appendAttributeValue(result, attribute.value(), documentIsHTML);
         result.append('"');
     }
 }
 
 void MarkupAccumulator::appendCDATASection(StringBuilder& result, const String& section)
 {
     // FIXME: CDATA content is not escaped, but XMLSerializer (and possibly other callers) should raise an exception if it includes "]]>".
@@ skipping 97 matching lines @@
 
     String str = node.nodeValue();
     if (startPosition().containerNode() == node)
         str.truncate(endPosition().offsetInContainerNode());
     if (endPosition().containerNode() == node)
         str.remove(0, startPosition().offsetInContainerNode());
     return str;
 }
 
 }