XSSAuditor: truncate form action attribute like other src-like attributes

third_party/WebKit/Source/core/html/parser/XSSAuditor.cpp

 /*
  * Copyright (C) 2011 Adam Barth. All Rights Reserved.
  * Copyright (C) 2011 Daniel Bates (dbates@intudata.com).
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 631 matching lines @@
   DCHECK(HasName(request.token, baseTag));
 
   return EraseAttributeIfInjected(request, hrefAttr, String(),
                                   kSrcLikeAttributeTruncation);
 }
 
 bool XSSAuditor::FilterFormToken(const FilterTokenRequest& request) {
   DCHECK_EQ(request.token.GetType(), HTMLToken::kStartTag);
   DCHECK(HasName(request.token, formTag));
 
-  return EraseAttributeIfInjected(request, actionAttr, kURLWithUniqueOrigin);
+  return EraseAttributeIfInjected(request, actionAttr, kURLWithUniqueOrigin,
+                                  kSrcLikeAttributeTruncation);
 }
 
 bool XSSAuditor::FilterInputToken(const FilterTokenRequest& request) {
   DCHECK_EQ(request.token.GetType(), HTMLToken::kStartTag);
   DCHECK(HasName(request.token, inputTag));
 
   return EraseAttributeIfInjected(request, formactionAttr, kURLWithUniqueOrigin,
                                   kSrcLikeAttributeTruncation);
 }
 
@@ skipping 274 matching lines @@
 }
 
 bool XSSAuditor::IsSafeToSendToAnotherThread() const {
   return document_url_.IsSafeToSendToAnotherThread() &&
          decoded_url_.IsSafeToSendToAnotherThread() &&
          decoded_http_body_.IsSafeToSendToAnotherThread() &&
          http_body_as_string_.IsSafeToSendToAnotherThread();
 }
 
 }  // namespace blink