Remove XSS from chrome://downloads

Remove XSS from chrome://downloads

BUG=668653
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation

Committed: https://crrev.com/6d9a7916b48581f72fda060a1210ebef7f89b229
Cr-Commit-Position: refs/heads/master@{#435104}

[robwu, 2016-11-25 11:09:39]

Description was changed from

==========
Remove XSS from chrome://downloads

BUG=668653
==========

to

==========
Remove XSS from chrome://downloads

BUG=668653
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation
==========

[robwu, 2016-11-25 11:09:56]

The CQ bit was checked by rob@robwu.nl to run a CQ dry run

[commit-bot: I haz the power, 2016-11-25 11:10:10]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[robwu, 2016-11-25 11:12:28]

rob@robwu.nl changed reviewers:
+ dbeam@chromium.org

[commit-bot: I haz the power, 2016-11-25 11:18:56]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-11-25 11:18:57]

Dry run: Try jobs failed on following builders:
  closure_compilation on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/closure_compila...)

[robwu, 2016-11-25 15:11:16]

The CQ bit was checked by rob@robwu.nl to run a CQ dry run

[commit-bot: I haz the power, 2016-11-25 15:11:31]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-11-25 16:17:06]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-11-25 16:17:06]

Dry run: This issue passed the CQ dry run.

[robwu, 2016-11-29 00:00:07]

dbeam@ Ping. This is easy to review, so PTAL.

[Dan Beam, 2016-11-29 04:29:53]

https://codereview.chromium.org/2526323004/diff/20001/chrome/browser/resource...
File chrome/browser/resources/md_downloads/item.js (right):

https://codereview.chromium.org/2526323004/diff/20001/chrome/browser/resource...
chrome/browser/resources/md_downloads/item.js:119: return
loadTimeData.getStringF('controlledByUrl', url, HTMLEscape(name));
why escape just name?

[robwu, 2016-11-29 08:26:22]

https://codereview.chromium.org/2526323004/diff/20001/chrome/browser/resource...
File chrome/browser/resources/md_downloads/item.js (right):

https://codereview.chromium.org/2526323004/diff/20001/chrome/browser/resource...
chrome/browser/resources/md_downloads/item.js:119: return
loadTimeData.getStringF('controlledByUrl', url, HTMLEscape(name));
On 2016/11/29 04:29:53, Dan Beam wrote:
> why escape just name?

The extension ID is always a sequence of 32 characters from a-p.

[Dan Beam, 2016-11-29 19:17:24]

lgtm

[robwu, 2016-11-29 21:17:08]

The CQ bit was checked by rob@robwu.nl

[robwu, 2016-11-29 21:17:09]

The patchset sent to the CQ was uploaded after l-g-t-m from dbeam@chromium.org
Link to the patchset: https://codereview.chromium.org/2526323004/#ps40001
(title: "Run chrome/browser/resources/vulcanize.py")

[commit-bot: I haz the power, 2016-11-29 21:17:52]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-11-29 23:21:15]

CQ is committing da patch.

Bot data: {"patchset_id": 40001, "attempt_start_ts": 1480454228616270,
"parent_rev": "23f2b528bbd9c2811626d94e21ac63a445c5c6d1", "commit_rev":
"48ad1966813bf7ac1d55b061c45be242e23aeade"}

[commit-bot: I haz the power, 2016-11-29 23:21:49]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-11-29 23:26:57]

Description was changed from

==========
Remove XSS from chrome://downloads

BUG=668653
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation
==========

to

==========
Remove XSS from chrome://downloads

BUG=668653
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation

Committed: https://crrev.com/6d9a7916b48581f72fda060a1210ebef7f89b229
Cr-Commit-Position: refs/heads/master@{#435104}
==========

[commit-bot: I haz the power, 2016-11-29 23:26:58]

Patchset 3 (id:??) landed as
https://crrev.com/6d9a7916b48581f72fda060a1210ebef7f89b229
Cr-Commit-Position: refs/heads/master@{#435104}