Index: net/base/data_url.cc |
diff --git a/net/base/data_url.cc b/net/base/data_url.cc |
index e6477646e6c0f2a909032861bff94f6b4a9d491f..0ec345ea6dbf4f89ed5701e132109e6c7e411a41 100644 |
--- a/net/base/data_url.cc |
+++ b/net/base/data_url.cc |
@@ -14,6 +14,7 @@ |
#include "base/strings/string_util.h" |
#include "net/base/escape.h" |
#include "net/base/mime_util.h" |
+#include "net/http/http_util.h" |
#include "url/gurl.h" |
namespace net { |
@@ -57,6 +58,10 @@ bool DataURL::Parse(const GURL& url, std::string* mime_type, |
} else if (charset->empty() && |
iter->compare(0, kCharsetTagLength, kCharsetTag) == 0) { |
charset->assign(iter->substr(kCharsetTagLength)); |
+ // The grammar for charset is not specially defined in RFC2045 and |
+ // RFC2397. It just needs to be a token. |
+ if (!net::HttpUtil::IsToken(*charset)) |
+ return false; |
} |
} |