| Index: Source/core/html/parser/XSSAuditor.cpp
|
| diff --git a/Source/core/html/parser/XSSAuditor.cpp b/Source/core/html/parser/XSSAuditor.cpp
|
| index 66ffa14fa86d21de51c4babaeff99758d20bb81b..6f50091ceb97d50f93226436dee808ca41644340 100644
|
| --- a/Source/core/html/parser/XSSAuditor.cpp
|
| +++ b/Source/core/html/parser/XSSAuditor.cpp
|
| @@ -575,7 +575,7 @@ String XSSAuditor::decodedSnippetForAttribute(const FilterTokenRequest& request,
|
| if (treatment == SrcLikeAttribute) {
|
| int slashCount = 0;
|
| bool commaSeen = false;
|
| - // In HTTP URLs, characters following the first ?, #, or third slash may come from
|
| + // In HTTP URLs, characters following the first ?, #, or third slash may come from
|
| // the page itself and can be merely ignored by an attacker's server when a remote
|
| // script or script-like resource is requested. In DATA URLS, the payload starts at
|
| // the first comma, and the the first /*, //, or <!-- may introduce a comment. Characters
|
| @@ -595,10 +595,10 @@ String XSSAuditor::decodedSnippetForAttribute(const FilterTokenRequest& request,
|
| commaSeen = true;
|
| }
|
| } else if (treatment == ScriptLikeAttribute) {
|
| - // Beware of trailing characters which came from the page itself, not the
|
| + // Beware of trailing characters which came from the page itself, not the
|
| // injected vector. Excluding the terminating character covers common cases
|
| // where the page immediately ends the attribute, but doesn't cover more
|
| - // complex cases where there is other page data following the injection.
|
| + // complex cases where there is other page data following the injection.
|
| // Generally, these won't parse as javascript, so the injected vector
|
| // typically excludes them from consideration via a single-line comment or
|
| // by enclosing them in a string literal terminated later by the page's own
|
| @@ -655,7 +655,7 @@ String XSSAuditor::decodedSnippetForJavaScript(const FilterTokenRequest& request
|
|
|
| String result;
|
| while (startPosition < endPosition && !result.length()) {
|
| - // Stop at next comment (using the same rules as above for SVG/XML vs HTML), when we
|
| + // Stop at next comment (using the same rules as above for SVG/XML vs HTML), when we
|
| // encounter a comma, or when we exceed the maximum length target. The comma rule
|
| // covers a common parameter concatenation case performed by some webservers.
|
| // After hitting the length target, we can only stop at a point where we know we are
|
| @@ -708,7 +708,7 @@ bool XSSAuditor::isLikelySafeResource(const String& url)
|
| // request, ignoring scheme and port considerations. If the resource has a
|
| // query string, we're more suspicious, however, because that's pretty rare
|
| // and the attacker might be able to trick a server-side script into doing
|
| - // something dangerous with the query string.
|
| + // something dangerous with the query string.
|
| if (m_documentURL.host().isEmpty())
|
| return false;
|
|
|
|
|