Password manager internals page: Improve security

chrome/browser/ui/webui/password_manager_internals/password_manager_internals_ui.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/password_manager_internals/password_manager_internals_ui.h"
 
 #include <set>
 
 #include "base/strings/string16.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
 #include "chrome/browser/password_manager/chrome_password_manager_client.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/android/tab_model/tab_model.h"
 #include "chrome/browser/ui/android/tab_model/tab_model_list.h"
 #include "chrome/browser/ui/tab_contents/tab_contents_iterator.h"
 #include "chrome/common/url_constants.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui.h"
 #include "content/public/browser/web_ui_data_source.h"
 #include "grit/password_manager_internals_resources.h"
+#include "net/base/escape.h"
 
 using content::BrowserContext;
 using content::WebContents;
 
 namespace {
 
 content::WebUIDataSource* CreatePasswordManagerInternalsHTMLSource() {
   content::WebUIDataSource* source = content::WebUIDataSource::Create(
       chrome::kChromeUIPasswordManagerInternalsHost);
 
@@ skipping 24 matching lines @@
                                 CreatePasswordManagerInternalsHTMLSource());
   NotifyAllPasswordManagerClients(PAGE_OPENED);
 }
 
 PasswordManagerInternalsUI::~PasswordManagerInternalsUI() {
   NotifyAllPasswordManagerClients(PAGE_CLOSED);
 }
 
 void PasswordManagerInternalsUI::LogSavePasswordProgress(
     const std::string& text) {
-  base::StringValue text_string_value(text);
+  base::StringValue text_string_value(net::EscapeForHTML(text));
   web_ui()->CallJavascriptFunction("addSavePasswordProgressLog",
                                    text_string_value);
 }
 
 void PasswordManagerInternalsUI::NotifyAllPasswordManagerClients(
     ClientNotificationType notification_type) {
   // First, find all the WebContents objects of the current profile.
   Profile* current_profile = Profile::FromWebUI(web_ui());
   std::set<WebContents*> profile_web_contents;
 #if defined(OS_ANDROID)
@@ skipping 22 matching lines @@
     switch (notification_type) {
       case PAGE_OPENED:
         client->SetLogger(this);
         break;
       case PAGE_CLOSED:
         client->SetLogger(NULL);
         break;
     }
   }
 }