Off by one in XSSAuditor::canonicalizedSnippetForJavaScript()

Source/core/html/parser/XSSAuditor.cpp

 /*
  * Copyright (C) 2011 Adam Barth. All Rights Reserved.
  * Copyright (C) 2011 Daniel Bates (dbates@intudata.com).
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 749 matching lines @@
                 if (startsSingleLineCommentAt(string, foundPosition)
                     || startsMultiLineCommentAt(string, foundPosition)
                     || startsHTMLCommentAt(string, foundPosition)) {
                     break;
                 }
             }
             if (string[foundPosition] == ',' || string[foundPosition] == '`')
                 break;
 
             if (lastNonSpacePosition != kNotFound && startsOpeningScriptTagAt(string, foundPosition)) {
-                foundPosition = lastNonSpacePosition;
+                foundPosition = lastNonSpacePosition + 1;
                 break;
             }
             if (foundPosition > startPosition + kMaximumFragmentLengthTarget) {
                 // After hitting the length target, we can only stop at a point where we know we are
                 // not in the middle of a %-escape sequence. For the sake of simplicity, approximate
                 // not stopping inside a (possibly multiply encoded) %-escape sequence by breaking on
                 // whitespace only. We should have enough text in these cases to avoid false positives.
                 if (isHTMLSpace<UChar>(string[foundPosition]))
                     break;
             }
@@ skipping 41 matching lines @@
 
 bool XSSAuditor::isSafeToSendToAnotherThread() const
 {
     return m_documentURL.isSafeToSendToAnotherThread()
         && m_decodedURL.isSafeToSendToAnotherThread()
         && m_decodedHTTPBody.isSafeToSendToAnotherThread()
         && m_httpBodyAsString.isSafeToSendToAnotherThread();
 }
 
 } // namespace blink