| Index: net/base/data_url.cc
|
| diff --git a/net/base/data_url.cc b/net/base/data_url.cc
|
| index e6477646e6c0f2a909032861bff94f6b4a9d491f..0ec345ea6dbf4f89ed5701e132109e6c7e411a41 100644
|
| --- a/net/base/data_url.cc
|
| +++ b/net/base/data_url.cc
|
| @@ -14,6 +14,7 @@
|
| #include "base/strings/string_util.h"
|
| #include "net/base/escape.h"
|
| #include "net/base/mime_util.h"
|
| +#include "net/http/http_util.h"
|
| #include "url/gurl.h"
|
|
|
| namespace net {
|
| @@ -57,6 +58,10 @@ bool DataURL::Parse(const GURL& url, std::string* mime_type,
|
| } else if (charset->empty() &&
|
| iter->compare(0, kCharsetTagLength, kCharsetTag) == 0) {
|
| charset->assign(iter->substr(kCharsetTagLength));
|
| + // The grammar for charset is not specially defined in RFC2045 and
|
| + // RFC2397. It just needs to be a token.
|
| + if (!net::HttpUtil::IsToken(*charset))
|
| + return false;
|
| }
|
| }
|
|
|
|
|