Make WebPageSerializerImpl to escape URL attribute values in result.

third_party/WebKit/Source/web/WebPageSerializerImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 269 matching lines @@
     m_dataBuffer.clear();
 
     CString encodedContent = param->textEncoding.normalizeAndEncode(content, WTF::EntitiesForUnencodables);
 
     // Send result to the client.
     m_client->didSerializeDataForFrame(param->url,
                                        WebCString(encodedContent.data(), encodedContent.length()),
                                        status);
 }
 
+// TODO(yosin): We should utilize |MarkupFormatter| here to share code,
+// especially escaping attribute values, done by |WebEntities| |m_htmlEntities|
+// and |m_xmlEntities|.
 void WebPageSerializerImpl::openTagToString(Element* element,
                                             SerializeDomParam* param)
 {
     bool needSkip;
     StringBuilder result;
     // Do pre action for open tag.
     result.append(preActionBeforeSerializeOpenTag(element, param, &needSkip));
     if (needSkip)
         return;
     // Add open tag
     result.append('<');
     result.append(element->nodeName().lower());
     // Go through all attributes and serialize them.
     AttributeCollection attributes = element->attributes();
     AttributeCollection::iterator end = attributes.end();
     for (AttributeCollection::iterator it = attributes.begin(); it != end; ++it) {
         result.append(' ');
         // Add attribute pair
         result.append(it->name().toString());
         result.appendLiteral("=\"");
         if (!it->value().isEmpty()) {
             const String& attrValue = it->value();
 
             // Check whether we need to replace some resource links
             // with local resource paths.
             const QualifiedName& attrName = it->name();
             if (element->hasLegalLinkAttribute(attrName)) {
                 // For links start with "javascript:", we do not change it.
                 if (attrValue.startsWith("javascript:", TextCaseInsensitive)) {
-                    result.append(attrValue);
+                    result.append(m_htmlEntities.convertEntitiesInString(attrValue));
                 } else {
                     // Get the absolute link
                     WebLocalFrameImpl* subFrame = WebLocalFrameImpl::fromFrameOwnerElement(element);
                     String completeURL = subFrame ? subFrame->frame()->document()->url() :
                                                     param->document->completeURL(attrValue);
                     // Check whether we have local files for those link.
                     if (m_localLinks.contains(completeURL)) {
                         if (!param->directoryName.isEmpty()) {
                             result.appendLiteral("./");
                             result.append(param->directoryName);
                             result.append('/');
                         }
-                        result.append(m_localLinks.get(completeURL));
+                        result.append(m_htmlEntities.convertEntitiesInString(m_localLinks.get(completeURL)));
                     } else {
-                        result.append(completeURL);
+                        result.append(m_htmlEntities.convertEntitiesInString(completeURL));
                     }
                 }
             } else {
                 if (param->isHTMLDocument)
                     result.append(m_htmlEntities.convertEntitiesInString(attrValue));
                 else
                     result.append(m_xmlEntities.convertEntitiesInString(attrValue));
             }
         }
         result.append('\"');
@@ skipping 128 matching lines @@
 
         encodeAndFlushBuffer(WebPageSerializerClient::CurrentFrameIsFinished, &param, ForceFlush);
     }
 
     ASSERT(m_dataBuffer.isEmpty());
     m_client->didSerializeDataForFrame(KURL(), WebCString("", 0), WebPageSerializerClient::AllFramesAreFinished);
     return didSerialization;
 }
 
 }  // namespace blink