Experiment with blocking resolution of HTTP URLs containing '\n' and '<'.

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 4929 matching lines @@
           m_visuallyOrdered ? EOrder::kVisual : EOrder::kLogical);
     }
     setNeedsStyleRecalc(SubtreeStyleChange,
                         StyleChangeReasonForTracing::create(
                             StyleChangeReason::VisuallyOrdered));
   }
 }
 
 KURL Document::completeURL(const String& url) const {
   String trimmed = url.stripWhiteSpace();
+  KURL completed = completeURLWithOverride(url, m_baseURL);
+
   bool newline = trimmed.contains('\n') || trimmed.contains('\r');
-  bool brace = trimmed.contains('<');
-  if (newline)
-    UseCounter::count(*this, UseCounter::DocumentCompleteURLContainingNewline);
-  if (brace) {
-    UseCounter::count(*this,
-                      UseCounter::DocumentCompleteURLContainingOpenBrace);
-  }
-  if (newline && brace) {
+  bool lessThan = trimmed.contains('<');
+  if ((newline || lessThan) && completed.protocolIsInHTTPFamily()) {
+    if (newline) {
+      UseCounter::count(*this,
+                        UseCounter::DocumentCompleteURLHTTPContainingNewline);
+    }
+    if (lessThan) {
+      UseCounter::count(*this,
+                        UseCounter::DocumentCompleteURLHTTPContainingLessThan);
+    }
+    if (newline && lessThan) {
+      UseCounter::count(
+          *this,
+          UseCounter::DocumentCompleteURLHTTPContainingNewlineAndLessThan);
+
+      if (RuntimeEnabledFeatures::restrictCompleteURLCharacterSetEnabled())
+        return KURL();
+    }
+  } else if (newline || lessThan) {
     UseCounter::count(
-        *this, UseCounter::DocumentCompleteURLContainingNewlineAndOpenBrace);
+        *this,
+        UseCounter::DocumentCompleteURLNonHTTPContainingNewlineOrLessThan);
   }
   return completeURLWithOverride(url, m_baseURL);
 }
 
 KURL Document::completeURLWithOverride(const String& url,
                                        const KURL& baseURLOverride) const {
   DCHECK(baseURLOverride.isEmpty() || baseURLOverride.isValid());
 
   // Always return a null URL when passed a null string.
   // FIXME: Should we change the KURL constructor to have this behavior?
@@ skipping 1546 matching lines @@
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif