XSS Auditor: Block by default.

third_party/WebKit/Source/core/html/parser/XSSAuditor.cpp

 /*
  * Copyright (C) 2011 Adam Barth. All Rights Reserved.
  * Copyright (C) 2011 Daniel Bates (dbates@intudata.com).
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 372 matching lines @@
           SecurityMessageSource, ErrorMessageLevel,
           "Error parsing header X-XSS-Protection: " + headerValue + ": " +
               errorDetails + " at character position " +
               String::format("%u", errorPosition) +
               ". The default protections will be applied."));
     }
 
     m_xssProtection = xssProtectionHeader;
     if (m_xssProtection == ReflectedXSSInvalid ||
         m_xssProtection == ReflectedXSSUnset) {
-      m_xssProtection = FilterReflectedXSS;
+      m_xssProtection = BlockReflectedXSS;
     }
 
     if (auditorDelegate)
       auditorDelegate->setReportURL(xssProtectionReportURL.copy());
 
     EncodedFormData* httpBody = documentLoader->request().httpBody();
     if (httpBody && !httpBody->isEmpty())
       m_httpBodyAsString = httpBody->flattenToString();
   }
 
@@ skipping 497 matching lines @@
 }
 
 bool XSSAuditor::isSafeToSendToAnotherThread() const {
   return m_documentURL.isSafeToSendToAnotherThread() &&
          m_decodedURL.isSafeToSendToAnotherThread() &&
          m_decodedHTTPBody.isSafeToSendToAnotherThread() &&
          m_httpBodyAsString.isSafeToSendToAnotherThread();
 }
 
 }  // namespace blink