Remove XSS from chrome://downloads

chrome/browser/resources/md_downloads/item.js

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 cr.define('downloads', function() {
   var Item = Polymer({
     is: 'downloads-item',
 
     properties: {
       data: {
@@ skipping 98 matching lines @@
              !this.data.file_externally_removed;
     },
 
     /** @private */
     computeControlledBy_: function() {
       if (!this.data.by_ext_id || !this.data.by_ext_name)
         return '';
 
       var url = 'chrome://extensions#' + this.data.by_ext_id;
       var name = this.data.by_ext_name;
-      return loadTimeData.getStringF('controlledByUrl', url, name);
+      return loadTimeData.getStringF('controlledByUrl', url, HTMLEscape(name));
     },
 
     /** @private */
     computeDangerIcon_: function() {
       return this.isDangerous_ ? 'cr:warning' : '';
     },
 
     /** @private */
     computeDate_: function() {
       assert(typeof this.data.hideDate == 'boolean');
@@ skipping 181 matching lines @@
     },
 
     /** @private */
     onShowTap_: function() {
       downloads.ActionService.getInstance().show(this.data.id);
     },
   });
 
   return {Item: Item};
 });