Prevent linear-time forcing of tokens by inducing XSSAuditor page blocks.

Source/core/html/parser/XSSAuditor.cpp

Index: Source/core/html/parser/XSSAuditor.cpp
diff --git a/Source/core/html/parser/XSSAuditor.cpp b/Source/core/html/parser/XSSAuditor.cpp
index 0f27adb9a2702709f91855b56171c88164cd807f..a1e1852201d23ac858c3b5065a2e26f52d128f4d 100644
--- a/Source/core/html/parser/XSSAuditor.cpp
+++ b/Source/core/html/parser/XSSAuditor.cpp
@@ -710,7 +710,14 @@ String XSSAuditor::canonicalize(String snippet, TruncationKind treatment)
     String decodedSnippet = fullyDecodeString(snippet, m_encoding);
 
     if (treatment != NoTruncation) {
-        decodedSnippet.truncate(kMaximumFragmentLengthTarget);
+        if (decodedSnippet.length() > kMaximumFragmentLengthTarget) {
+            // Let the page influence the stopping point to avoid disclosing leading fragments.
+            // Stop when we hit whitespace, since that is unlikely to be part a leading fragment.
+            size_t position = kMaximumFragmentLengthTarget;
+            while (position < decodedSnippet.length() && !isHTMLSpace(decodedSnippet[position]))
+                ++position;
+            decodedSnippet.truncate(position);
+        }
         if (treatment == SrcLikeAttributeTruncation)
             truncateForSrcLikeAttribute(decodedSnippet);
         else if (treatment == ScriptLikeAttributeTruncation)