Index: Source/core/html/parser/XSSAuditor.cpp |
diff --git a/Source/core/html/parser/XSSAuditor.cpp b/Source/core/html/parser/XSSAuditor.cpp |
index 66ffa14fa86d21de51c4babaeff99758d20bb81b..6f50091ceb97d50f93226436dee808ca41644340 100644 |
--- a/Source/core/html/parser/XSSAuditor.cpp |
+++ b/Source/core/html/parser/XSSAuditor.cpp |
@@ -575,7 +575,7 @@ String XSSAuditor::decodedSnippetForAttribute(const FilterTokenRequest& request, |
if (treatment == SrcLikeAttribute) { |
int slashCount = 0; |
bool commaSeen = false; |
- // In HTTP URLs, characters following the first ?, #, or third slash may come from |
+ // In HTTP URLs, characters following the first ?, #, or third slash may come from |
// the page itself and can be merely ignored by an attacker's server when a remote |
// script or script-like resource is requested. In DATA URLS, the payload starts at |
// the first comma, and the the first /*, //, or <!-- may introduce a comment. Characters |
@@ -595,10 +595,10 @@ String XSSAuditor::decodedSnippetForAttribute(const FilterTokenRequest& request, |
commaSeen = true; |
} |
} else if (treatment == ScriptLikeAttribute) { |
- // Beware of trailing characters which came from the page itself, not the |
+ // Beware of trailing characters which came from the page itself, not the |
// injected vector. Excluding the terminating character covers common cases |
// where the page immediately ends the attribute, but doesn't cover more |
- // complex cases where there is other page data following the injection. |
+ // complex cases where there is other page data following the injection. |
// Generally, these won't parse as javascript, so the injected vector |
// typically excludes them from consideration via a single-line comment or |
// by enclosing them in a string literal terminated later by the page's own |
@@ -655,7 +655,7 @@ String XSSAuditor::decodedSnippetForJavaScript(const FilterTokenRequest& request |
String result; |
while (startPosition < endPosition && !result.length()) { |
- // Stop at next comment (using the same rules as above for SVG/XML vs HTML), when we |
+ // Stop at next comment (using the same rules as above for SVG/XML vs HTML), when we |
// encounter a comma, or when we exceed the maximum length target. The comma rule |
// covers a common parameter concatenation case performed by some webservers. |
// After hitting the length target, we can only stop at a point where we know we are |
@@ -708,7 +708,7 @@ bool XSSAuditor::isLikelySafeResource(const String& url) |
// request, ignoring scheme and port considerations. If the resource has a |
// query string, we're more suspicious, however, because that's pretty rare |
// and the attacker might be able to trick a server-side script into doing |
- // something dangerous with the query string. |
+ // something dangerous with the query string. |
if (m_documentURL.host().isEmpty()) |
return false; |