Make XSSAuditor aware of ECMA6 template strings.

Source/core/html/parser/XSSAuditor.cpp

 /*
  * Copyright (C) 2011 Adam Barth. All Rights Reserved.
  * Copyright (C) 2011 Daniel Bates (dbates@intudata.com).
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 738 matching lines @@
                 startPosition = foundPosition + 2;
             else
                 startPosition = endPosition;
         } else
             break;
     }
 
     String result;
     while (startPosition < endPosition && !result.length()) {
         // Stop at next comment (using the same rules as above for SVG/XML vs HTML), when we encounter a comma,
-        // when we hit an opening <script> tag, or when we exceed the maximum length target. The comma rule
-        // covers a common parameter concatenation case performed by some web servers.
+        // when we encoutner a backtick, when we hit an opening <script> tag, or when we exceed the maximum length
+        // target. The comma rule covers a common parameter concatenation case performed by some web servers. The
+        // backtick rule covers the ECMA6 multi-line template string feature.
         lastNonSpacePosition = kNotFound;
         for (foundPosition = startPosition; foundPosition < endPosition; foundPosition++) {
             if (!request.shouldAllowCDATA) {
                 if (startsSingleLineCommentAt(string, foundPosition)
                     || startsMultiLineCommentAt(string, foundPosition)
                     || startsHTMLCommentAt(string, foundPosition)) {
                     break;
                 }
             }
-            if (string[foundPosition] == ',')
+            if (string[foundPosition] == ',' || string[foundPosition] == '`')
                 break;
 
             if (lastNonSpacePosition != kNotFound && startsOpeningScriptTagAt(string, foundPosition)) {
                 foundPosition = lastNonSpacePosition;
                 break;
             }
             if (foundPosition > startPosition + kMaximumFragmentLengthTarget) {
                 // After hitting the length target, we can only stop at a point where we know we are
                 // not in the middle of a %-escape sequence. For the sake of simplicity, approximate
                 // not stopping inside a (possibly multiply encoded) %-escape sequence by breaking on
@@ skipping 45 matching lines @@
 
 bool XSSAuditor::isSafeToSendToAnotherThread() const
 {
     return m_documentURL.isSafeToSendToAnotherThread()
         && m_decodedURL.isSafeToSendToAnotherThread()
         && m_decodedHTTPBody.isSafeToSendToAnotherThread()
         && m_httpBodyAsString.isSafeToSendToAnotherThread();
 }
 
 } // namespace blink