Escapes backslash, colon, comma, equals and semicolon in IAccessible2 string attributes.

content/browser/accessibility/browser_accessibility_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/accessibility/browser_accessibility_win.h"
 
 #include <UIAutomationClient.h>
 #include <UIAutomationCoreApi.h>
 
 #include <algorithm>
@@ skipping 3237 matching lines @@
         win_attributes_->ia2_attributes.push_back(L"invalid:spelling");
         break;
       case ui::AX_INVALID_STATE_GRAMMAR:
         win_attributes_->ia2_attributes.push_back(L"invalid:grammar");
         break;
       case ui::AX_INVALID_STATE_OTHER:
         {
           base::string16 aria_invalid_value;
           if (GetString16Attribute(ui::AX_ATTR_ARIA_INVALID_VALUE,
                                    &aria_invalid_value)) {
+            SanitizeStringAttributeForIA2(aria_invalid_value,
+                                          &aria_invalid_value);
             win_attributes_->ia2_attributes.push_back(
                 L"invalid:" + aria_invalid_value);
           } else {
             // Set the attribute to L"true", since we cannot be more specific.
             win_attributes_->ia2_attributes.push_back(L"invalid:true");
           }
         }
         break;
       default:
         NOTREACHED();
@@ skipping 132 matching lines @@
     relation->AddRef();
     relation->Initialize(this, IA2_RELATION_LABELLED_BY);
     relation->AddTarget(title_elem_id);
     relations_.push_back(relation);
   }
 
   // Expose slider value.
   if (ia_role() == ROLE_SYSTEM_PROGRESSBAR ||
       ia_role() == ROLE_SYSTEM_SCROLLBAR ||
       ia_role() == ROLE_SYSTEM_SLIDER) {
-    win_attributes_->ia2_attributes.push_back(L"valuetext:" + GetValueText());
+    base::string16 value_text = GetValueText();
+    SanitizeStringAttributeForIA2(value_text, &value_text);
+    win_attributes_->ia2_attributes.push_back(L"valuetext:" + value_text);
   }
 
   // Expose dropeffect attribute.
-  base::string16 dropEffect;
-  if (GetHtmlAttribute("aria-dropeffect", &dropEffect))
-    win_attributes_->ia2_attributes.push_back(L"dropeffect:" + dropEffect);
+  base::string16 drop_effect;
+  if (GetHtmlAttribute("aria-dropeffect", &drop_effect)) {
+    SanitizeStringAttributeForIA2(drop_effect, &drop_effect);
+    win_attributes_->ia2_attributes.push_back(L"dropeffect:" + drop_effect);
+  }
 
   // Expose grabbed attribute.
   base::string16 grabbed;
-  if (GetHtmlAttribute("aria-grabbed", &grabbed))
+  if (GetHtmlAttribute("aria-grabbed", &grabbed)) {
+    SanitizeStringAttributeForIA2(grabbed, &grabbed);
     win_attributes_->ia2_attributes.push_back(L"grabbed:" + grabbed);
+  }
 
   // Expose datetime attribute.
   base::string16 datetime;
   if (GetRole() == ui::AX_ROLE_TIME &&
-      GetHtmlAttribute("datetime", &datetime))
+      GetHtmlAttribute("datetime", &datetime)) {
+    SanitizeStringAttributeForIA2(datetime, &datetime);
     win_attributes_->ia2_attributes.push_back(L"datetime:" + datetime);
+  }
 
   // Expose input-text type attribute.
   base::string16 type;
-  if (GetRole() == ui::AX_ROLE_TEXT_FIELD &&
-      GetHtmlAttribute("type", &type))
+  if (GetRole() == ui::AX_ROLE_TEXT_FIELD && GetHtmlAttribute("type", &type)) {
+    SanitizeStringAttributeForIA2(type, &type);
     win_attributes_->ia2_attributes.push_back(L"text-input-type:" + type);
+  }
 
   // If this is a web area for a presentational iframe, give it a role of
   // something other than DOCUMENT so that the fact that it's a separate doc
   // is not exposed to AT.
   if (IsWebAreaForPresentationalIframe()) {
     win_attributes_->ia_role = ROLE_SYSTEM_GROUPING;
     win_attributes_->ia2_role = ROLE_SYSTEM_GROUPING;
   }
 }
 
@@ skipping 180 matching lines @@
 
   if (str.empty())
     return S_FALSE;
 
   *value_bstr = SysAllocString(str.c_str());
   DCHECK(*value_bstr);
 
   return S_OK;
 }
 
+// Static
+void BrowserAccessibilityWin::SanitizeStringAttributeForIA2(
+    const base::string16& input,
+    base::string16* output) {
+  DCHECK(output);
+  // According to the IA2 Spec, these characters need to be escaped with a
+  // backslash: backslash, colon, comma, equals and semicolon.
+  // Note that backslash must be replaced first.
+  base::ReplaceChars(input, L"\\", L"\\\\", output);
+  base::ReplaceChars(*output, L":", L"\\:", output);
+  base::ReplaceChars(*output, L",", L"\\,", output);
+  base::ReplaceChars(*output, L"=", L"\\=", output);
+  base::ReplaceChars(*output, L";", L"\\;", output);
+}
+
 void BrowserAccessibilityWin::StringAttributeToIA2(
     ui::AXStringAttribute attribute,
     const char* ia2_attr) {
   base::string16 value;
   if (GetString16Attribute(attribute, &value)) {
+    SanitizeStringAttributeForIA2(value, &value);
     win_attributes_->ia2_attributes.push_back(
         base::ASCIIToUTF16(ia2_attr) + L":" + value);
   }
 }
 
 void BrowserAccessibilityWin::BoolAttributeToIA2(
     ui::AXBoolAttribute attribute,
     const char* ia2_attr) {
   bool value;
   if (GetBoolAttribute(attribute, &value)) {
@@ skipping 972 matching lines @@
     ia2_role = ia_role;
 
   win_attributes_->ia_role = ia_role;
   win_attributes_->ia_state = ia_state;
   win_attributes_->role_name = role_name;
   win_attributes_->ia2_role = ia2_role;
   win_attributes_->ia2_state = ia2_state;
 }
 
 }  // namespace content