Add test for history HTML escaping issue....

chrome/browser/session_history_uitest.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "app/l10n_util.h"
 #include "base/file_path.h"
 #include "base/platform_thread.h"
 #include "base/string_util.h"
+#include "chrome/common/url_constants.h"
 #include "chrome/test/automation/tab_proxy.h"
 #include "chrome/test/automation/browser_proxy.h"
 #include "chrome/test/ui/ui_test.h"
 #include "grit/generated_resources.h"
 #include "net/base/net_util.h"
 #include "net/url_request/url_request_unittest.h"
 
 using std::wstring;
 
 namespace {
@@ skipping 475 matching lines @@
   // visible.
   scoped_refptr<HTTPTestServer> server =
       HTTPTestServer::CreateServer(kDocRoot, NULL);
   ASSERT_TRUE(NULL != server.get());
 
   ASSERT_TRUE(tab_->NavigateToURL(server->TestServerPage(
       "files/session_history/replace.html?no-title.html")));
   EXPECT_EQ(L"", GetTabTitle());
 }
 
+TEST_F(SessionHistoryTest, HistorySearchXSS) {
+  // about:blank should be loaded first.
+  ASSERT_FALSE(tab_->GoBack());
+  EXPECT_EQ(L"", GetTabTitle());
+
+  GURL url(std::string(chrome::kChromeUIHistoryURL) +
+      "#q=%3Cimg%20src%3Dx%3Ax%20onerror%3D%22document.title%3D'XSS'%22%3E");
+  ASSERT_TRUE(tab_->NavigateToURL(url));
+  // Mainly, this is to ensure we send a synchronous message to the renderer
+  // so that we're not susceptible (less susceptible?) to a race condition.
+  // Should a race condition ever trigger, it won't result in flakiness.
+  int num = tab_->FindInPage(L"<img", FWD, CASE_SENSITIVE, false, NULL);
+  EXPECT_GT(num, 0);
+  EXPECT_EQ(L"History", GetTabTitle());
+}
+
 }  // namespace