Escapes backslash, colon, comma, equals and semicolon in IAccessible2 string attributes.

content/browser/accessibility/browser_accessibility_win.cc

Index: content/browser/accessibility/browser_accessibility_win.cc
diff --git a/content/browser/accessibility/browser_accessibility_win.cc b/content/browser/accessibility/browser_accessibility_win.cc
index 2704b423ed54c8633197ed4da2c0599453e312a2..daeba4e6443973a2ca143f68ea4435502ff73cb6 100644
--- a/content/browser/accessibility/browser_accessibility_win.cc
+++ b/content/browser/accessibility/browser_accessibility_win.cc
@@ -3631,11 +3631,26 @@ HRESULT BrowserAccessibilityWin::GetStringAttributeAsBstr(
   return S_OK;
 }
 
+// Static
+void BrowserAccessibilityWin::SanitizeStringAttributeForIA2(
+    const base::string16& input,
+    base::string16* output) {
+  // According to the IA2 Spec, these characters need to be escaped with a
+  // backslash: backslash, colon, comma, equals and semicolon.
+  // Note that backslash must be replaced first.
+  base::ReplaceChars(input, L"\\", L"\\\\", output);
+  base::ReplaceChars(input, L":", L"\\:", output);

[dmazzoni, 2015/10/12 17:15:15]

This won't work correctly if input and output are different. In the calling
function, input and output are the same and it happens to work in that case.

+  base::ReplaceChars(input, L",", L"\\,", output);
+  base::ReplaceChars(input, L"=", L"\\=", output);
+  base::ReplaceChars(input, L";", L"\\;", output);
+}
+
 void BrowserAccessibilityWin::StringAttributeToIA2(
     ui::AXStringAttribute attribute,
     const char* ia2_attr) {
   base::string16 value;
   if (GetString16Attribute(attribute, &value)) {
+    SanitizeStringAttributeForIA2(value, &value);
     win_attributes_->ia2_attributes.push_back(
         base::ASCIIToUTF16(ia2_attr) + L":" + value);
   }