Prevent linear-time forcing of tokens by inducing XSSAuditor page blocks.

Source/core/html/parser/XSSAuditor.cpp

 /*
  * Copyright (C) 2011 Adam Barth. All Rights Reserved.
  * Copyright (C) 2011 Daniel Bates (dbates@intudata.com).
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 692 matching lines @@
     int start = attribute.nameRange.start - request.token.startIndex();
     int end = attribute.valueRange.end - request.token.startIndex();
     return request.sourceTracker.sourceForToken(request.token).substring(start, end - start);
 }
 
 String XSSAuditor::canonicalize(String snippet, TruncationKind treatment)
 {
     String decodedSnippet = fullyDecodeString(snippet, m_encoding);
 
     if (treatment != NoTruncation) {
-        decodedSnippet.truncate(kMaximumFragmentLengthTarget);
+        if (decodedSnippet.length() > kMaximumFragmentLengthTarget) {
+            // Let the page influence the stopping point to avoid disclosing leading fragments.
+            // Stop when we hit whitespace, since that is unlikely to be part a leading fragment.
+            size_t position = kMaximumFragmentLengthTarget;
+            while (position < decodedSnippet.length() && !isHTMLSpace(decodedSnippet[position]))
+                ++position;
+            decodedSnippet.truncate(position);
+        }
         if (treatment == SrcLikeAttributeTruncation)
             truncateForSrcLikeAttribute(decodedSnippet);
         else if (treatment == ScriptLikeAttributeTruncation)
             truncateForScriptLikeAttribute(decodedSnippet);
     }
 
     return decodedSnippet.removeCharacters(&isNonCanonicalCharacter);
 }
 
 String XSSAuditor::canonicalizedSnippetForJavaScript(const FilterTokenRequest& request)
@@ skipping 102 matching lines @@
 
 bool XSSAuditor::isSafeToSendToAnotherThread() const
 {
     return m_documentURL.isSafeToSendToAnotherThread()
         && m_decodedURL.isSafeToSendToAnotherThread()
         && m_decodedHTTPBody.isSafeToSendToAnotherThread()
         && m_httpBodyAsString.isSafeToSendToAnotherThread();
 }
 
 } // namespace blink