Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(125)

Unified Diff: chrome/browser/resources/ntp4/apps_page.js

Issue 2542593002: Fix XSS in app launcher and remove use of unvalidated URL (Closed)
Patch Set: Created 4 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | chrome/browser/ui/webui/ntp/app_launcher_handler.cc » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: chrome/browser/resources/ntp4/apps_page.js
diff --git a/chrome/browser/resources/ntp4/apps_page.js b/chrome/browser/resources/ntp4/apps_page.js
index e1f4a0050fbdedafeeee6b6f36dc7ecc272b2529..9e7b71e6d4044d1005beb4f00e9e66d60da39b23 100644
--- a/chrome/browser/resources/ntp4/apps_page.js
+++ b/chrome/browser/resources/ntp4/apps_page.js
@@ -396,13 +396,8 @@ cr.define('ntp', function() {
onClick_: function(e) {
if (/** @type {MouseEvent} */(e).button > 1) return;
- var url = !this.appData_.is_webstore ? '' :
- appendParam(this.appData_.url,
- 'utm_source',
- 'chrome-ntp-icon');
-
chrome.send('launchApp',
- [this.appId, APP_LAUNCH.NTP_APPS_MAXIMIZED, url,
+ [this.appId, APP_LAUNCH.NTP_APPS_MAXIMIZED, 'chrome-ntp-icon',
e.button, e.altKey, e.ctrlKey, e.metaKey, e.shiftKey]);
// Don't allow the click to trigger a link or anything
@@ -709,9 +704,9 @@ cr.define('ntp', function() {
if (html) {
// It's important that we don't attach this node to the document
// because it might contain scripts.
- var node = this.ownerDocument.createElement('div');
- node.innerHTML = html;
- title = node.textContent;
+ var doc = document.implementation.createHTMLDocument();
+ doc.body.innerHTML = html;
+ title = doc.body.textContent;
}
// Make sure title is >=1 and <=45 characters for Chrome app limits.
« no previous file with comments | « no previous file | chrome/browser/ui/webui/ntp/app_launcher_handler.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698