Escape '&' in javascript URLs for innerHTML/outerHTML

Source/core/editing/MarkupAccumulator.h

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 100 matching lines @@
     // included into serialized text then extracts image, object, etc. The size
     // of this vector isn't small for large document. It is better to use
     // callback like functionality.
     RawPtrWillBeMember<WillBeHeapVector<RawPtrWillBeMember<Node>>> const m_nodes;
 
     String renderedText(Text&);
     String stringValueForRange(const Node&);
 
 private:
     String resolveURLIfNeeded(const Element&, const String&) const;
-    void appendQuotedURLAttributeValue(StringBuilder&, const Element&, const Attribute&);
+    void appendHTMLEscapedURLAttributeValue(StringBuilder&, const Element&, const Attribute&);

[fs, 2015/03/24 10:20:11]

I think you should keep the old name - the conversion to escapes/entities only
take place for javascript: URLs.

[Abhijeet Kandalkar Slow, 2015/03/24 14:20:36]

Done.

     void serializeNodesWithNamespaces(Node& targetNode, EChildrenOnly, const Namespaces*);
     bool serializeAsHTMLDocument(const Node&) const;
 
     StringBuilder m_markup;
     const EAbsoluteURLs m_resolveURLsMethod;
     SerializationType m_serializationType;
     const Position m_start;
     const Position m_end;
 };
 
 }
 
 #endif