Value sanitization for input[type=text] should not truncate a value at control character

Source/core/html/forms/TextFieldInputType.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 385 matching lines @@
     return c == '\r' || c == '\n';
 }
 
 static String limitLength(const String& string, unsigned maxLength)
 {
     unsigned newLength = std::min(maxLength, string.length());
     // FIXME: We should not truncate the string at a control character. It's not
     // compatible with IE and Firefox.
     for (unsigned i = 0; i < newLength; ++i) {
         const UChar current = string[i];
-        if (current < ' ' && current != '\t') {
+        if (current < ' ' && current != '\t' && current != '\v') {

[tkent, 2014/03/07 17:26:34]

Please follow the FIXME comment above.

[Habib Virji, 2014/03/10 12:02:56]

Done.

             newLength = i;
             break;
         }
     }
     if (newLength == string.length())
         return string;
     if (newLength > 0 && U16_IS_LEAD(string[newLength - 1]))
         --newLength;
     return string.left(newLength);
 }
@@ skipping 142 matching lines @@
 {
     return !element().isDisabledOrReadOnly();
 }
 
 bool TextFieldInputType::shouldSpinButtonRespondToWheelEvents()
 {
     return shouldSpinButtonRespondToMouseEvents() && element().focused();
 }
 
 } // namespace WebCore