Escapes backslash, colon, comma, equals and semicolon in IAccessible2 string attributes.

content/browser/accessibility/browser_accessibility_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/accessibility/browser_accessibility_win.h"
 
 #include <UIAutomationClient.h>
 #include <UIAutomationCoreApi.h>
 
 #include <algorithm>
@@ skipping 3237 matching lines @@
         win_attributes_->ia2_attributes.push_back(L"invalid:spelling");
         break;
       case ui::AX_INVALID_STATE_GRAMMAR:
         win_attributes_->ia2_attributes.push_back(L"invalid:grammar");
         break;
       case ui::AX_INVALID_STATE_OTHER:
         {
           base::string16 aria_invalid_value;
           if (GetString16Attribute(ui::AX_ATTR_ARIA_INVALID_VALUE,
                                    &aria_invalid_value)) {
             win_attributes_->ia2_attributes.push_back(

[dmazzoni, 2015/10/12 17:15:15]

There are other places where we're adding strings to the ia2_attributes vector
too, like this one - you should make sure those are escaped too.

                 L"invalid:" + aria_invalid_value);
           } else {
             // Set the attribute to L"true", since we cannot be more specific.
             win_attributes_->ia2_attributes.push_back(L"invalid:true");
           }
         }
         break;
       default:
         NOTREACHED();
     }
@@ skipping 355 matching lines @@
 
   if (str.empty())
     return S_FALSE;
 
   *value_bstr = SysAllocString(str.c_str());
   DCHECK(*value_bstr);
 
   return S_OK;
 }
 
+// Static
+void BrowserAccessibilityWin::SanitizeStringAttributeForIA2(
+    const base::string16& input,
+    base::string16* output) {
+  // According to the IA2 Spec, these characters need to be escaped with a
+  // backslash: backslash, colon, comma, equals and semicolon.
+  // Note that backslash must be replaced first.
+  base::ReplaceChars(input, L"\\", L"\\\\", output);
+  base::ReplaceChars(input, L":", L"\\:", output);

[dmazzoni, 2015/10/12 17:15:15]

This won't work correctly if input and output are different. In the calling
function, input and output are the same and it happens to work in that case.

+  base::ReplaceChars(input, L",", L"\\,", output);
+  base::ReplaceChars(input, L"=", L"\\=", output);
+  base::ReplaceChars(input, L";", L"\\;", output);
+}
+
 void BrowserAccessibilityWin::StringAttributeToIA2(
     ui::AXStringAttribute attribute,
     const char* ia2_attr) {
   base::string16 value;
   if (GetString16Attribute(attribute, &value)) {
+    SanitizeStringAttributeForIA2(value, &value);
     win_attributes_->ia2_attributes.push_back(
         base::ASCIIToUTF16(ia2_attr) + L":" + value);
   }
 }
 
 void BrowserAccessibilityWin::BoolAttributeToIA2(
     ui::AXBoolAttribute attribute,
     const char* ia2_attr) {
   bool value;
   if (GetBoolAttribute(attribute, &value)) {
@@ skipping 972 matching lines @@
     ia2_role = ia_role;
 
   win_attributes_->ia_role = ia_role;
   win_attributes_->ia_state = ia_state;
   win_attributes_->role_name = role_name;
   win_attributes_->ia2_role = ia2_role;
   win_attributes_->ia2_state = ia2_state;
 }
 
 }  // namespace content