Escape '&' in javascript URLs for innerHTML/outerHTML

Source/core/editing/MarkupAccumulator.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 200 matching lines @@
 }
 
 void MarkupAccumulator::appendQuotedURLAttributeValue(StringBuilder& result, const Element& element, const Attribute& attribute)
 {
     ASSERT(element.isURLAttribute(attribute));
     const String resolvedURLString = resolveURLIfNeeded(element, attribute.value());
     UChar quoteChar = '"';
     String strippedURLString = resolvedURLString.stripWhiteSpace();
     if (protocolIsJavaScript(strippedURLString)) {
         // minimal escaping for javascript urls
+        if (strippedURLString.contains('&'))
+            strippedURLString.replaceWithLiteral('&', "&");
+
         if (strippedURLString.contains('"')) {
             if (strippedURLString.contains('\''))
                 strippedURLString.replaceWithLiteral('"', """);
             else
                 quoteChar = '\'';
         }
         result.append(quoteChar);
         result.append(strippedURLString);
         result.append(quoteChar);
         return;
@@ skipping 354 matching lines @@
 
     String str = node.nodeValue();
     if (startPosition().containerNode() == node)
         str.truncate(endPosition().offsetInContainerNode());
     if (endPosition().containerNode() == node)
         str.remove(0, startPosition().offsetInContainerNode());
     return str;
 }
 
 }